Attackers are actively exploiting a critical, unauthenticated remote code execution (RCE) vulnerability in PaperCut NG and PaperCut MF, widely used print management software, security researchers at Huntress have confirmed.
The flaw allows an attacker to remotely take control of a PaperCut server’s configuration without needing any login credentials, ultimately enabling arbitrary code execution on the underlying system. PaperCut published an “urgent security advisory” on 27 August, warning customers that the vulnerability was being exploited in the wild, and has since released emergency patches for versions 25 and 26 of both products. A fix for version 24 is still in progress, and the vendor is treating all NG and MF versions as potentially affected.
Confirmed exploitation in the wild
Huntress said it has observed exploitation of the flaw across two customer environments. In one incident, attackers ran a base64-encoded command decoding to whoami & ver, used to identify the compromised account and operating system version. The activity in that case lasted under two minutes.
In a second incident, researchers found a hex-encoded Java .class file had been dropped onto the target system, in a folder inside the PaperCut server’s own installation directory. When decompiled, the file revealed code capable of profiling the host operating system, listing files on the machine, and writing the results out before deleting itself and its output, along with the server’s own log files, to cover its tracks.
A further command observed by Huntress decoded to whoami & ver & tasklist, suggesting attackers were also enumerating running processes on compromised hosts.
Researchers reproduce full attack chain
Beyond observing real-world attacks, Huntress said it had independently reproduced the vulnerability against a stock, unpatched installation of PaperCut NG, building a complete proof-of-concept exploit chain. The team said it was able to trigger pre-authenticated code execution that spawned a process running with SYSTEM-level privileges, the highest level of access on a Windows system under the PaperCut Application Server process.
According to Huntress, the root cause lies in how PaperCut’s authorisation checks handle certain crafted requests: the software can be tricked into checking permissions against the wrong internal component, allowing an unauthenticated request to reach sensitive server configuration endpoints that should otherwise require a login.
Huntress said it is currently working with PaperCut to coordinate further analysis of the vulnerability.
Guidance for affected organisations
Huntress and PaperCut are urging organisations running PaperCut NG or MF to:
- Apply PaperCut’s emergency patch for their supported version immediately.
- Remove any public internet exposure of the PaperCut Application Server, restricting access to trusted IPs or placing it behind a VPN.
- Restrict or monitor outbound SMB traffic from the PaperCut server, which Huntress’s proof-of-concept chain used to deliver a malicious payload.
- Preserve server logs and configuration data before patching or restarting, where a server has been publicly exposed, to support any forensic investigation.
- Watch for PaperCut’s listed indicators of compromise, including missing or truncated server.log files and specific database error strings.
Organisations unable to patch immediately are being told to treat network isolation of affected servers as urgent.
Huntress said it is continuing to investigate the vulnerability and related exploitation activity, and will update its findings as the picture develops.
