Print Infrastructure & Active Exploitation Alert: PaperCut Emergency Advisory Warns of Pre-Auth Java RCE Chain (PaperCut NG & MF)
Executive Summary
On August 27–28, 2026, print management software vendor PaperCut Software and threat researchers at Huntress issued an urgent security advisory warning of active in-the-wild exploitation targeting PaperCut NG and PaperCut MF print management application servers. The vulnerability allows unauthenticated network-positioned attackers to bypass access controls, alter trusted configuration parameters, and execute arbitrary Java bytecode inside the server's runtime process with full administrative privileges. PaperCut released emergency security updates for versions 25 and 26 (PaperCut NG 25.0.12.76497 and PaperCut MF 25.0.12.76496 for Windows), urging organizations to isolate internet-exposed management ports immediately.
Deep-Dive Technical Analysis of the PaperCut RCE Exploit Chain
The vulnerability represents a critical authentication and trusted-configuration flaw in PaperCut's web management interface:
1. Trusted Configuration Parameter Manipulation
PaperCut NG/MF servers manage multi-function printer fleets, user authentication quotas, and secure document queues:
* The Authentication Bypass Vector: Unauthenticated remote attackers send crafted HTTP/HTTPS requests to the web management console (default ports 9191/9192) that abuse misconfigured parameter validation filters.
* Configuration State Modification: The bypass allows the attacker to manipulate internal application settings that are normally restricted to authenticated Super Administrators, including system logging directives, script execution hooks, and user synchronization routines.
2. Arbitrary Java Bytecode Execution & Web Shell Deployment
Once trusted configuration controls are altered, the exploit achieves code execution:
* Java Process Execution: The attacker triggers internal server workflows that instantiate and execute arbitrary Java classes directly within the server process (running as SYSTEM on Windows or root/papercut on Linux).
* Persistence & Lateral Movement: Telemetry observed by Huntress indicates that threat actors are actively deploying persistent JSP and PowerShell web shells, dumping domain credentials from memory, and scanning internal subnets to pivot into enterprise Active Directory environments.
Vulnerability Overview
Technical Attribute
Detail
Impacted Software
PaperCut NG & PaperCut MF (All versions prior to emergency updates)
Patched Builds
Version 25 (NG 25.0.12.76497, MF 25.0.12.76496) & Version 26
Vulnerability Class
Authentication Bypass to Remote Code Execution (CWE-287 / CWE-94)
Severity
Critical (CVSS 9.8 / 10.0)
Active Exploitation
Confirmed in the wild by PaperCut Software and Huntress Labs
Why Print Management Servers Remain High-Value Targets
Print management servers sit at a critical intersection of enterprise IT: they require deep integration with Active Directory for user authentication, maintain persistent connections across internal subnets, and frequently run with elevated system privileges. When exposed to the public internet or accessible across untrusted network segments, a single pre-authentication flaw grants attackers an immediate foothold into internal corporate infrastructure.
Recommendations and Mitigations
IT administrators and security teams running PaperCut should take the following immediate actions:
1. Apply Emergency Security Updates Immediately: Upgrade PaperCut NG/MF installations to the latest emergency maintenance releases (version 25 or 26) without delay:
* PaperCut NG Windows: 25.0.12.76497
* PaperCut MF Windows: 25.0.12.76496
2. Eliminate Public Internet Exposure: Ensure PaperCut management web interfaces (ports 9191 and 9192) are never directly accessible from the public internet. Restrict access strictly to trusted internal subnets or require a VPN with multi-factor authentication.
3. Inspect Application and System Logs: Review PaperCut application logs, web server access logs, and process creation telemetry (e.g., pc-app.exe spawning cmd.exe, powershell.exe, or unexpected Java child processes) for indicators of compromise (IoCs).
4. Audit Service Account Privileges: Ensure the PaperCut service runs under a dedicated, least-privilege service account rather than Local System or high-privilege domain administrator accounts.