PaperCut Confirms Two Chained Zero-Days Exploited Across All NG and MF Versions

PaperCut is telling every customer running its print-management software to treat this as an emergency: attackers are actively exploiting two chained zero-day vulnerabilities that affect all versions of PaperCut NG and PaperCut MF, and the fix is an out-of-cycle patch the company shipped in the middle of the night.

The vendor confirmed the attacks in an urgent security advisory first posted on August 27, 2026, saying it is "aware of confirmed customer incidents and is treating this matter with the highest priority." Over the next day and a half the picture sharpened. Two CVEs were assigned, outside researchers reproduced a full remote-code-execution chain, and PaperCut replaced its first emergency build with a hardened second one. If you operate a PaperCut Application Server, the practical takeaway is simple and time-sensitive: apply Release 2 for v25 or v26 now, or take the server off the public internet until you can.

What PaperCut Is Telling Customers

PaperCut disclosed the problem before it had CVE identifiers, CVSS scores, or a named vulnerability class, which is unusual and tells you how fast this moved. Rapid7 noted in its emergency write-up that the initial advisory shipped without those standard fields, a sign the vendor chose speed over completeness once it had confirmed real intrusions. The company’s "security emergency response team" reproduced the flaw using forensic data supplied by a university customer that had been hit, then rushed builds out the door.

At 2:10 a.m. AEST on August 28, 2026, PaperCut released emergency, out-of-cycle builds for both the v25 and v26 branches of NG and MF, covering the Windows, Linux, and macOS installers, as SecurityWeek reported. Within hours the company went further and published an updated Emergency Patch, labeled Release 2, that adds hardening beyond the first fix. The instruction to defenders is blunt: install Release 2 even if you already applied the original emergency patch.

The single most important thing to know is that there is no unaffected version. This is not a "patch if you are on an old build" situation. Every deployment of PaperCut NG and PaperCut MF is in scope until it is patched or walled off.

Figure: The first-hour decision for anyone running a PaperCut Application Server. Patch to Release 2, or isolate the server before doing anything else.

What the Two CVEs Actually Are

The attacks chain two distinct flaws, and the numbering is worth getting right because early reporting varied. Per PaperCut’s own advisory and Help Net Security, the pair is CVE-2026-82078 and CVE-2026-81578.

CVE-2026-82078 stems from unsafe dynamic class loading in the database connection utilities of PaperCut MF and PaperCut NG. In plain terms, it lets an attacker get the server to run arbitrary Java bytecode, which is a remote-code-execution primitive. CVE-2026-81578 is an improper access control flaw in the web management interface. It lets an unauthenticated remote attacker modify certain system configurations. Used together, the access-control gap opens the door and the class-loading flaw runs code behind it.

Security firm Huntress, which worked with PaperCut on the response, said it "reproduced a pre-authentication, remote configuration takeover and a complete remote code execution chain against a stock installation of PaperCut NG 25.0.11.75758," the previous public build in the 25.0 line. That is the key qualifier for defenders: the researchers describe the chain as pre-authentication, meaning an attacker does not need valid credentials to start. Huntress reported seeing exploitation in two customer environments, with post-exploitation activity that ran basic reconnaissance commands to identify the account and operating system on the compromised host.

Who Is Affected

PaperCut NG is print-management software widely deployed in offices, schools, universities, and government. PaperCut MF is the multi-function variant that ties into the big all-in-one copiers, running from the machine’s touchscreen and integrating with hardware from most major printer brands. Both share the same Application Server, which the vendor describes as the "brain" of the deployment, and organizations typically run just one.

That concentration is exactly why this matters. A single exposed Application Server is often the control point for every managed printer in a building or campus, and print servers tend to sit on internal networks with broad reach. This is not the first time PaperCut has drawn ransomware attention: in 2023, affiliates of the Clop and LockBit operations exploited CVE-2023-27350 to deploy ransomware, a campaign serious enough to land in CISA’s Known Exploited Vulnerabilities catalog. The 2026 flaws are a fresh pair, not a rerun of that bug, but the target profile is the same.

What We Still Do Not Know

Several facts remain open, and I am flagging them rather than filling the gaps. As of this writing, PaperCut and the researchers have not published CVSS severity scores for either CVE, so treat any specific number you see as unconfirmed until the vendor or the National Vulnerability Database posts it. Attribution is also unknown. The Hacker News noted there are "currently no details about the flaw, how it is being exploited, or who is behind the efforts," and no threat group has been named. No specific victim organizations have been publicly identified beyond the anonymized university customer whose forensic data seeded the fix.

CISA Known Exploited Vulnerabilities status is not confirmed either. Given confirmed in-the-wild exploitation of enterprise software, both CVEs are strong candidates for the catalog, but I could not verify a KEV entry at publication. Federal agencies should watch for a listing, since that would start the clock on a binding remediation deadline. Because this is a developing story, expect the details to shift, and check the vendor advisory for the current build numbers.

What Defenders Should Do Now

• Patch to Release 2 immediately. Apply the v25 or v26 Emergency Patch (Release 2) to your PaperCut NG or MF Application Server, on Windows, Linux, or macOS. Install Release 2 even if you already applied the first emergency patch, because it carries additional hardening.
• If you cannot patch this hour, isolate the server. Take the Application Server offline, or restrict its web interfaces to trusted internal IP addresses using firewall rules or network access controls. PaperCut’s guidance is to do this "even if you have not observed suspicious activity."
• Get PaperCut off the public internet, permanently. An Application Server should not be reachable from untrusted addresses. If yours is, that is the exploited surface, and internet exposure should be treated as an incident-worthy misconfiguration once this is over.
• Hunt in the logs. Review the PaperCut server.log for files that are missing, truncated, or deleted, and for the two error strings the vendor flagged: ERROR No suitable driver found for jdbc:no:x and ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST. Watch endpoint and network alerts tied to the Application Server, particularly suspicious activity from the pc-app.exe process.
• Assume compromise if you were exposed. A server that sat on the internet before patching should be investigated, not just updated. This is where fast, disciplined incident response earns its keep.

If you manage patch priorities across a large estate, this belongs at the top of the queue today. It has the three ingredients that make a flaw dangerous in practice: confirmed exploitation, no authentication requirement, and a target that is everywhere. That combination is the reason a mature vulnerability management program treats "actively exploited zero-day" as a different category from routine patching, and why understanding the difference between a zero-day exploit, a vulnerability, and an attack changes how fast you move.

My read: This is an assessment, not a reported fact. The riskiest thing about this one is not the exploit chain, it is the deployment pattern. PaperCut servers are boring infrastructure that nobody thinks about until they break, they often run with generous internal network access, and a meaningful number are exposed to the internet by teams who never intended them to be. That is the same setup that made the 2023 PaperCut bug a ransomware on-ramp. The vendor moved fast and communicated clearly here, and the patch story is good. The failure mode will be organizations that do not know they run PaperCut, or do not know their server is internet-facing, and therefore never see the advisory in time.

For related recent cases of enterprise software exploited within days of disclosure, see our coverage of GitLab CVE-2026-19478 exploited days after disclosure and Shadowserver’s count of compromised Zimbra servers.

Updated August 28, 2026: PaperCut assigned CVE-2026-82078 and CVE-2026-81578, and released Emergency Patch Release 2 with additional hardening. Install Release 2 even if the first patch was already applied.

Primary Documents

• PaperCut, URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)
• Rapid7, PaperCut NG/MF Critical Zero-Day Exploited in the Wild
• SecurityWeek, PaperCut Releases Emergency Patch for Exploited Zero-Day
• Huntress, PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE