PaperCut Zero-Day Alert: Pre-Auth RCE Chain Exploited in Wild Across NG and MF Print Servers
Executive Summary
PaperCut Software has issued an urgent security bulletin confirming that threat actors are actively exploiting a critical, unauthenticated remote code execution (RCE) vulnerability in all versions of PaperCut NG and PaperCut MF print management software (The Hacker News, BleepingComputer). The flaw allows remote, unauthenticated attackers to bypass authorization checks, alter trusted application configuration settings, and execute arbitrary Java code with SYSTEM or root privileges on target servers (Huntress Security Blog).
Deep-Dive Technical Analysis
Component Invocation Confusion & Authorization Failure
PaperCut NG and MF are deployed across thousands of enterprise, healthcare, education, and government organizations to manage network printing, copying, and scanning infrastructure. Technical analysis by Huntress researchers John Hammond and Andrew Brandt revealed a severe logic flaw within PaperCut's web interface routing:
1. Page-Rendering vs. Action-Execution Discrepancy: In affected versions of PaperCut, a crafted HTTP request can specify one target page to be rendered for the visual response while simultaneously designating a different, administrative page to execute a component action.
2. Broken Access Control: PaperCut's access control verification incorrectly evaluates permissions against the public, unauthenticated rendered page rather than the privileged component performing the backend action.
3. Configuration Overwrite: By exploiting this permission confusion, an unauthenticated remote attacker can submit parameters that modify trusted server configuration settings without providing valid credentials.
4. Arbitrary Java Code Execution: The altered configuration enables the attacker to trigger internal execution routines that run arbitrary Java code inside the PaperCut application server process, achieving full system-level control (NT AUTHORITY\SYSTEM on Windows or root on Linux).
Enterprise Threat Landscape & Post-Exploitation Risks
Print servers occupy a privileged architectural position within corporate environments, making them primary targets for ransomware syndicates and cyber espionage groups:
* Centralized Active Directory Foothold: PaperCut servers maintain high-privilege service account connections to Active Directory and LDAP directories for user authentication, allowing attackers to dump domain credentials and move laterally across enterprise networks.
* Immediate Lateral Pivoting: Attackers weaponize initial PaperCut access to install persistent web shells, disable endpoint security controls, and deploy network-wide ransomware.
Actionable Recommendations & Mitigations
1. Upgrade PaperCut Immediately: Apply the emergency patches released on August 27, 2026, updating installations to versions 25.0.3, 24.1.4, or 23.1.8 (or the latest release for your branch).
2. Restrict Inbound Network Access: Block all external, public internet access to PaperCut web administration and service ports (TCP 9191 and 9192), ensuring management consoles are reachable only via dedicated administrative VLANs or Zero Trust Network Access (ZTNA) gateways.
3. Audit Server Configuration and Logs: Inspect PaperCut application logs (server.log) for anomalous unauthenticated POST requests targeting administrative component handlers and verify that no unauthorized administrative accounts or scheduled maintenance scripts have been created.
4. Deploy EDR Process Monitoring: Configure Endpoint Detection and Response (EDR) agents to detect abnormal child processes (such as cmd.exe, powershell.exe, or sh) spawned by the PaperCut Java server process (pc-app.exe or Java daemon).
________________
Sources & References: The Hacker News, Huntress Security Blog, BleepingComputer.