Full Report
Two security vulnerabilities in the PaperCut NG and MF print management software, patched last week after being exploited as zero-days, are now being abused in data theft attacks. [...]
Analysis Summary
# Incident Report: Zero-Day Exploitation of PaperCut NG/MF for Data Theft
## Executive Summary
Two critical vulnerabilities in PaperCut NG and MF print management software (CVE-2026-81578 and CVE-2026-82078) were exploited as zero-days to bypass authentication and execute remote code. While emergency patches were released in late August 2026, threat actors are actively abusing these flaws to hijack external user-lookup features and exfiltrate database tables via Apache Derby. The impact is significant given PaperCut’s footprint of 100 million users across 70,000 organizations.
## Incident Details
- **Discovery Date:** August 27, 2026 (Patch release/Advisory)
- **Incident Date:** Active exploitation observed starting August 29, 2026 (following zero-day period)
- **Affected Organization:** 70,000+ organizations (including state agencies and educational institutions)
- **Sector:** Cross-sector (Education, Government, Enterprise)
- **Geography:** Global (800+ servers currently exposed online)
## Timeline of Events
### Initial Access
- **Date/Time:** August 2026 (Zero-day period); widespread honeypot activity detected Aug 29, 2026.
- **Vector:** Exploitation of chained vulnerabilities (CVE-2026-81578 and CVE-2026-82078).
- **Details:** Attackers bypass authentication on vulnerable PaperCut servers exposed to the internet.
### Lateral Movement
- **Details:** While specific lateral movement steps for the current campaign are undisclosed, historically, threat actors (like Muddywater and APT35) have used initial access via PaperCut to pivot deeper into corporate networks.
### Data Exfiltration/Impact
- **Details:** Threat actors are hijacking the "external user-lookup" feature. Specifically, they are dumping database tables via the **Apache Derby** database engine to steal sensitive user and organizational data.
### Detection & Response
- **How it was discovered:** Observed in honeypots by threat intelligence firm Defused.
- **Response actions taken:** PaperCut Software released two sets of emergency patches and published Indicators of Compromise (IoCs).
## Attack Methodology
- **Initial Access:** Authentication bypass via CVE-2026-81578 / CVE-2026-82078.
- **Persistence:** Not explicitly detailed in the report, though previous attacks involved RCE.
- **Privilege Escalation:** Chaining vulnerabilities to gain administrative control over the print server.
- **Defense Evasion:** Exploiting trusted print management software features (user-lookup).
- **Credential Access:** Potential theft of credentials stored within the PaperCut database tables.
- **Discovery:** Scanning for internet-facing PaperCut NG/MF servers (800+ identified).
- **Lateral Movement:** Chaining RCE to move from the print server to the broader network.
- **Collection:** Dumping database tables using Derby.
- **Exfiltration:** Stealing data via hijacked external lookup functions.
- **Impact:** Unauthorized data access and potential for further ransomware deployment.
## Impact Assessment
- **Financial:** Not yet disclosed; historical PaperCut exploits have led to costly ransomware incidents.
- **Data Breach:** High risk; dumping of DB tables implies theft of user identities, print logs, and system configurations.
- **Operational:** Disruption to print services; emergency patching requirements for 70,000 organizations.
- **Reputational:** Significant concern for PaperCut due to recurring zero-day vulnerabilities in the 2023–2026 period.
## Indicators of Compromise
- **Network indicators:** Activity involving suspicious external user-lookup requests.
- **File indicators:** Database dumps or exports originating from the Apache Derby engine.
- **Behavioral indicators:** Unexpected administrative access to PaperCut management consoles; unauthorized use of the "Print Archiving" or "User-Lookup" features.
## Response Actions
- **Containment:** Disconnect PaperCut servers from the public internet or restrict access via VPN/IP whitelisting.
- **Eradication:** Apply emergency patches released on August 27 and 28, 2026.
- **Recovery:** Conduct forensic audits of database logs to determine if data was exfiltrated prior to patching.
## Lessons Learned
- **Patch Management:** Zero-day vulnerabilities in ubiquitous management software (like print servers) require immediate, out-of-band patching.
- **Attack Surface:** Print management servers are high-value targets frequently overlooked in perimeter security audits.
- **Feature Abuse:** Security teams must monitor built-in "legal" features (like Print Archiving and User-Lookup) for anomalous behavior.
## Recommendations
- **Immediate Patching:** Update PaperCut NG and MF to the latest patched versions immediately.
- **Network Segmentation:** Ensure print servers are not directly accessible from the public internet.
- **Monitoring:** Implement logging and alerting for any database export activity (Derby) originating from the PaperCut application.
- **Zero Trust:** Apply the principle of least privilege to the service accounts running print management software.