TL;DR
- what: PaperCut disclosed on August 28, 2026 that attackers are exploiting a zero-day affecting all versions of PaperCut NG and PaperCut MF, with confirmed customer incidents under investigation.
- impact: A compromised PaperCut Application Server exposes service account credentials, the backing database, and directory integration, and the IOCs show attackers deleting server.log to cover the intrusion.
- fix: Apply the emergency patch for v25 or v26 and immediately restrict the Application Server web interfaces to trusted IP ranges with firewall or network access controls; no CVE has been assigned yet.
- who: Any organization running PaperCut NG or MF, with internet-exposed Application Servers and pre-v25 installations at the highest risk.
PaperCut confirmed on August 28, 2026 that attackers are exploiting a previously unknown flaw in PaperCut NG and PaperCut MF, and the company says every version of both products is affected. There is no CVE identifier yet, no technical detail on the bug, and no attribution. What PaperCut has released is an emergency patch for v25 and v26, a short list of indicators of compromise, and an instruction to firewall the Application Server web interface off the internet immediately, whether or not you see signs of intrusion.
Print management servers are a high value target because of where they sit. A PaperCut Application Server holds domain service account credentials, talks to a backing database, integrates with directory services, and runs with enough privilege to push drivers and jobs to endpoints across the estate. Exploiting it is not about printing. It is about the credential material and the reach.
What PaperCut has confirmed
The vendor language is narrow and worth reading precisely. PaperCut says it is aware of confirmed customer incidents and is treating the matter with the highest priority. Confirmed incidents means at least some organizations have been compromised, not merely scanned. The investigation is ongoing, which is why there is no CVE, no CVSS score, and no exploitation writeup.
The scope statement is the part that should drive your triage: all versions of PaperCut NG and PaperCut MF. The emergency patch covers v25 and v26 only. If you are running an older branch, you are exposed and you do not currently have a patch available. Network restriction is your only control until that changes.
⚠️ Restrict the Application Server today — PaperCut is telling customers to block untrusted internet access to the PaperCut web interfaces now, using firewall rules or network access controls, even with no suspicious activity observed. Treat that as a same-day change, not a change window item. Internet exposed print servers are the population being hit.
Indicators of compromise
- Alerts from IDS, EDR, or network monitoring tools involving the PaperCut Application Server, with particular attention to post-exploitation behavior originating from pc-app.exe
- server.log files that are missing, unexpectedly truncated, or deleted
- The string "ERROR No suitable driver found for jdbc:no:x" in server.log
- The string "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST" in server.log
Reading the artifacts
The two log strings hint at the shape of the bug even without a vendor advisory. "jdbc:no:x" is not a valid JDBC URL, and PaperCut only tries to load a driver for it if something supplied that string where a database connection descriptor was expected. That reads as attacker controlled input reaching a connection routine. The second string ties a database error to a cardID lookup with a CAST failure, which is consistent with injection into the card or identity lookup path. Together they point at an input path that reaches the database layer. Treat that as inference from the IOCs, not as confirmed root cause, because PaperCut has published neither.
Missing or truncated server.log is the more urgent signal. Log deletion is a deliberate anti-forensics step, and it means an intruder had the access needed to write to the server filesystem. If your server.log has a gap, assume compromise and open an incident. Do not wait for the CVE.
pc-app.exe is the PaperCut Application Server process on Windows. Anything spawning from it that is not PaperCut, a shell, a script host, a signed binary being abused, an outbound connection to an unfamiliar host, is post-exploitation activity. That is a straightforward EDR query, and you should run it against every PaperCut host you own, including the ones nobody remembers owning.
The 2023 precedent sets the ceiling
PaperCut has been here before. In 2023, CVE-2023-27350, CVSS 9.8, an authentication bypass leading to remote code execution in PaperCut MF and NG, was exploited at scale. Russian threat actors used it. So did Lace Tempest, a financially motivated group tracked as a Cl0p affiliate, which turned PaperCut access into Cl0p and LockBit ransomware deployments. The window between public disclosure and mass ransomware activity was measured in days.
That history matters for two reasons. The exploitation ecosystem already knows this product, already has tooling for it, and already knows what a PaperCut server is worth once you are inside. And unlike 2023, this round started as a zero-day, which means attackers set the timeline and defenders are reacting to it.
Action list for the next 24 hours
- Block internet access to the PaperCut Application Server web interfaces at the firewall, permitting only trusted internal ranges and named administrative sources.
- Apply the emergency patch for v25 or v26. If you are on an older branch, upgrade planning starts today and network isolation is your interim control.
- Collect server.log from every PaperCut host and check for the two error strings, for gaps, and for truncation. Preserve copies off the host before you do anything else to it.
- Hunt for child processes, script execution, and unexpected outbound connections from pc-app.exe across your full EDR retention window, not just the last day.
- Rotate the PaperCut service account and database credentials on any host you cannot clear, and review the directory group membership attached to that account.
- Inventory shadow PaperCut instances. Departmental print servers stood up outside central IT are the ones most likely to be sitting on a public IP.
What is not known yet
There is no CVE, no CVSS score, no published exploit mechanics, no named threat actor, and no count of affected organizations. PaperCut has not said how many confirmed incidents it is aware of, when exploitation began, or whether ransomware has been deployed in any of them. This is a developing disclosure and the technical picture will change over the coming days.
Do not wait for the CVE — The absence of a CVE identifier is a paperwork gap, not a risk assessment. The vendor has confirmed active exploitation and published usable IOCs, which is enough to justify the firewall change and a hunt. Assign the work against the vendor advisory now and back-fill the CVE reference when it is issued.
If you run PaperCut, the decision today is small and cheap: take the web interface off the public internet, apply the emergency patch if your version has one, and read your logs. The organizations that got hurt in 2023 were largely the ones that treated a print server as low priority infrastructure. The exploitation record says otherwise.
Originally published on RedEye Threat Intelligence.
