Full Report
PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company has released an emergency patch for v25 and v26 to address the issue. It said it's "aware of confirmed customer incidents and is treating this matter with the highest priority." An
Analysis Summary
# Vulnerability: PaperCut NG/MF Zero-Day Exploitation
## CVE Details
- **CVE ID**: Not yet assigned (Zero-day)
- **CVSS Score**: Pending (Likely Critical based on zero-day status and vendor response)
- **CWE**: Not yet specified
## Affected Systems
- **Products**: PaperCut NG, PaperCut MF
- **Versions**: All versions (specifically confirmed for v25 and v26)
- **Configurations**: Application Servers exposed to the internet are at the highest risk.
## Vulnerability Description
Technical details regarding the specific flaw are currently withheld by the vendor as the investigation is ongoing. However, logs suggest an issue related to database drivers and card identification lookups (referencing JDBC and SQL-like casting errors), which may point towards a database interaction or injection flaw.
## Exploitation
- **Status**: Exploited in the wild (Zero-day)
- **Complexity**: Not yet disclosed
- **Attack Vector**: Network (Remote)
## Impact
- **Confidentiality**: High (Likely, based on historical PaperCut exploits)
- **Integrity**: High (Confirmed incidents of server log tampering)
- **Availability**: High (Confirmed incidents of server log truncation/deletion)
## Remediation
### Patches
- **PaperCut v25**: Emergency patch released.
- **PaperCut v26**: Emergency patch released.
- *Note: Users on older versions should upgrade to these patched versions immediately.*
### Workarounds
- **Network Restriction**: Immediately restrict access to the PaperCut Application Server web interface to trusted IP addresses only.
- **Firewalling**: Use firewall rules or Network Access Controls (NAC) to ensure the interface is not reachable from the public internet.
## Detection
- **Indicators of Compromise (IoCs)**:
- Suspicious post-exploitation activity originating from the process `pc-app.exe`.
- `server.log` files that are missing, unexpectedly truncated, or deleted.
- **Log Entries (server.log)**:
- `ERROR No suitable driver found for jdbc:no:x`
- `ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST`
- **Detection Methods**: Monitor intrusion detection systems (IDS) and endpoint detection and response (EDR) tools for anomalies on the Application Server.
## References
- **Vendor Advisory**: hxxps[://]www[.]papercut[.]com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
- **News Source**: hxxps[://]thehackernews[.]com/2026/08/papercut-zero-day-exploited-in-attacks.html