PaperCut's Zero-Day Is Being Exploited Right Now: Every Version Is Exposed, and the Patch Race Is the Real Story

The short version//

PaperCut NG/MF — the print server that quietly lives in the corner of most small offices, and more than a few homelabs — is being actively exploited in the wild, and the scope is the worst kind: every supported version. The exploited flaw still has no CVE (the root cause is under investigation), there are confirmed customer incidents, and the alert didn't come from a bug bounty or a fuzzer. It came from a university customer's internal security and forensics team.

And the patch race is the story that should get your attention: an emergency patch for v25 and v26 shipped the morning after the bulletin, hardened Release 2 for every supported branch followed the same night.

What broke//

PaperCut's own security team is investigating what its URGENT bulletin calls "active exploitation of a vulnerability" in PaperCut NG and PaperCut MF. The university's forensics team handed them enough to reproduce the bug, and the emergency engineering team has been racing the clock since. As of this writing the exploited flaw is still unnamed. No CVE has been assigned, which is why this post's slug deliberately doesn't have one either.

But CVEs started landing while the original flaw was still a mystery:

• CVE-2026-82078 (CVSS 9.4, CRITICAL), unsafe dynamic class loading in the database connector (CWE-470). PaperCut instantiates a database driver class from a configurable driver name with no allowlist; if an attacker can manipulate the config, they can execute arbitrary Java bytecode that's sitting on the application classpath, under the PaperCut server process's security context.
• CVE-2026-81578 (CVSS 8.8, HIGH), an authentication bypass in the web management interface (CWE-306). Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions before the access check completes, letting a remote attacker modify certain system configuration.

Both are fixed in Emergency Patch Release 2, and PaperCut is telling all customers to install it even if they already applied the original emergency patch.

The patch race//

The bulletin's update log reads like a war room:

1. 27 Aug — initial URGENT bulletin. Immediate mitigation: if the Application Server is internet-reachable, restrict web access to trusted/internal IPs "even if you have not observed suspicious activity."
2. 28 Aug, 2:10am AEST — emergency patch for v25 and v26, the morning after the bulletin.
3. 28 Aug, 8:42pm AEST — Release 2 for v25 and v26, with additional hardening developed alongside Huntress and watchTowr, plus the security.properties gotcha below.
4. 28 Aug, 10:08pm AEST — Release 2 for v24.
5. 29 Aug — FAQ additions, and a note that SAML integration is under investigation.

By 10:08pm AEST on Aug 28 every supported branch had a hardened patch, with outside security firms in the loop the whole way. That's a genuinely strong vendor response. Most of us have waited a week for a vendor to acknowledge a bug.

The IOC hunt (and what it can't tell you)//

The bulletin publishes concrete indicators of compromise:

• Alerts from ID/EDR/network monitoring involving the PaperCut Application Server — particularly suspicious post-exploitation activity from pc-app.exe.
• Missing, unexpectedly truncated, or deleted server.log files.
• Either of these entries in server.log:
  • ERROR No suitable driver found for jdbc:no:x
  • ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

That second pair lines up neatly with the dynamic-class-loading flaw: jdbc:no:x is a driver name the app was never going to see, and the VALUES CAST line is the database connector chewing on attacker-shaped input.

PaperCut's own caveat: the absence of these artifacts is not confirmation that a system is clean. Validated, specific indicators are still being published to the bulletin as they're verified.

Two gotchas after you patch//

1. The security.properties key. If you use the (rarely used) external-database Card/ID number lookup feature, Release 2 requires adding security.card-number-lookup.enabled=Y to server/security.properties and restarting the Application Server. The key defaults to off (N), and without it PaperCut silently ignores external user lookup calls — even though the Admin UI will still show the feature as configured. That's the kind of regression that looks like a data problem for a week before anyone connects it to the patch.
2. Don't over-restrict. Mobility Print runs on a separate, unaffected architecture — per the bulletin's FAQ, its ports do not need restricting. If you blanket-firewalled everything PaperCut-related, this is where to double-check.

The print server curse//

This isn't the first time the corner of the room got picked. CVE-2023-27350, an unauthenticated authentication bypass in PaperCut leading to RCE as SYSTEM (CVSS 9.8), was exploited from mid-April 2023 onward, and CISA's joint advisory tied it to ransomware initial access, including the Bl00dy Ransomware Gang targeting the Education sector. It's been on KEV since April 2023. Trivia: some coverage of the 2023 incident cites "CVE-2023-27351." That's the sibling user-account-data (information-disclosure) CVE from the same Trend Micro report, not the RCE. Don't copy it.

The pattern for a self-hosting audience: the print server is not plumbing. It's a server app with a web UI, a database connector, and domain trust, the same attack-surface class as the admin-portal-with-a-crown stories we keep writing about (see the Gitea and vCenter posts from this month, and the ransom initial-access theme in the Gunra/FortiGate piece).

What you should do//

1. If PaperCut NG/MF can see the internet: restrict it to internal/trusted IPs right now. A firewall rule or network ACL in front of the web interfaces. PaperCut says do this even with zero observed suspicious activity.
2. Upgrade to Emergency Patch Release 2 for your branch (v24, v25, or v26). If you already applied the original emergency patch, apply Release 2 over it — it's explicitly recommended.
3. Hunt the IOCs above: pc-app.exe post-exploitation alerts, server.log missing or truncated, and the two log strings. Grep, don't eyeball.
4. If you use external-database card lookups, set security.card-number-lookup.enabled=Y in server/security.properties and restart — or the feature silently stops working after the patch.
5. Assume compromise if you were exposed and can't prove otherwise. Absence of artifacts is explicitly not proof of clean.
6. Watch the bulletin. It's still being actively updated and validated indicators will land there.