PaperCut has confirmed that hackers are actively exploiting an unpatched vulnerability in its widely used PaperCut NG and PaperCut MF print management software, prompting the company to rush out an emergency patch just hours after issuing its first warning.
The Australian vendor said its security response team is investigating “confirmed customer incidents” and is treating the matter with the highest priority, though a formal CVE identifier has not yet been assigned.
According to PaperCut’s security bulletin, the flaw affects every currently supported version of PaperCut NG and PaperCut MF, making version number irrelevant to exposure.
The company was alerted to the issue by a university customer’s internal security and digital forensics teams, whose findings allowed PaperCut engineers to reproduce the bug and confirm it was being actively abused in the wild.
Details of the vulnerability’s technical root cause remain undisclosed while the investigation continues, but the urgency of the response, including a same-day emergency build, signals a serious remote exploitation path against internet-facing servers.
PaperCut is telling every customer whose Application Server is reachable from the public internet to immediately restrict access to trusted IP ranges, such as internal networks, using firewall rules or equivalent network access controls.
Crucially, the company stressed that organizations should take this step now even if they have not observed any suspicious activity, since the absence of warning signs does not confirm a system is safe.
Security teams are also being asked to hunt for possible signs of compromise. Suspicious post-exploitation behavior originating from the pc-app.exe process, missing or unexpectedly truncated server.log files, and specific log entries reading “ERROR No suitable driver found for jdbc:no:x” or “ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST” may indicate an affected system.
PaperCut cautioned, however, that not finding these artifacts does not rule out a breach, and it plans to publish validated indicators of compromise as the investigation matures.
At 2:10 a.m. AEST on 28 August 2026, PaperCut released emergency, out-of-cycle builds for both v25 and v26 branches of NG and MF, covering Windows, Linux, and macOS installers.
The company explicitly labeled these as emergency releases rather than standard software updates, meant specifically for administrators running public-facing servers who cannot otherwise isolate their systems from the internet. A build for the older v24 branch is still in progress, and PaperCut is urging all customers to upgrade to the latest available version wherever feasible.
This is not the first time PaperCut’s print management platform has drawn attention from threat actors; a 2023 authentication bypass flaw, CVE-2023-27351, was previously exploited by ransomware affiliates and even reappeared in CISA’s Known Exploited Vulnerabilities catalog earlier this year.
Given that history, security researchers expect this newest bug to attract rapid attention from opportunistic attackers scanning for exposed servers, making swift patching and network segmentation essential for any organization running PaperCut in production.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
