PaperCut NG/MF Print Management Undisclosed Zero-Day Under Active Ransomware Exploitation Worldwide

On 27 August 2026, PaperCut issued an emergency advisory confirming an undisclosed zero-day in NG/MF print management software, already exploited in the wild with multiple customer incidents. Emergency patches shipped in the early hours of 28 August Beijing time, covering v25/v26 only. Public exposure must be locked down immediately.

Incident Overview

Australian print-management vendor PaperCut issued an emergency security advisory on 27 August 2026 confirming an undisclosed zero-day in the Application Server component of PaperCut NG and PaperCut MF, under active exploitation. A university customer first reported suspicious activity; the security team reproduced the flaw and confirmed a real intrusion. Multiple outlets (including BleepingComputer) followed. The incident now spans education, healthcare, government, and large-enterprise customers.

As of this writing, PaperCut has not assigned a CVE and has not published the root cause. `CVSS` score is also pending. Given this product's long history as an initial-access target for ransomware crews (Clop, LockBit, and others), and the precedent of CVE-2023-27350 (CVSS 9.8, auth bypass to RCE), PaperCut strongly recommends treating every Internet-exposed PaperCut Application Server as already compromised.

Technical Details

Attack surface and exploitation traits

PaperCut Application Server typically runs on Windows/Linux/macOS and serves a Web admin UI on default ports 9191 / 9192. Attackers hit Internet-reachable Application Server Web interfaces. Vulnerability class is undisclosed. Known attack pattern:

• Directly targets public-facing Application Server; no prior auth or weak password required.
• After reproduction, PaperCut security confirmed genuine in-the-wild exploitation.
• Post-exploit, legitimate `pc-app.exe` (or the platform equivalent) is used as the parent process for follow-on activity, evading some EDR behavioral monitoring.

Initial IoCs

PaperCut published several preliminary IoCs and stated they are incomplete:

• Legitimate `pc-app.exe` spawning suspicious children (`cmd.exe`, `powershell.exe`, `curl`, `wget`, `bash`, etc.).
• Application Server `server.log` deleted, truncated, or entirely missing.
• The following error entries in logs (indicates attempted exploitation):

`ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
`

PaperCut: absence of these indicators does not mean the system was not compromised. Attackers may wipe logs or use paths that never trigger these errors.

Impact Assessment

Blast radius is wide:

• Education: universities and K-12 widely deploy PaperCut for campus print quotas and roaming auth. FedRAMP / FBI previously warned on PaperCut exploitation in education.
• Healthcare: hospitals use PaperCut for outpatient, lab, and ward printing. HIPAA exposure risk.
• Government and legal: city/state agencies and law firms often expose PaperCut to the Internet; document flows contain sensitive data.
• Lateral-movement beachhead: even if print content is irrelevant, PaperCut servers typically integrate deeply with directory services and run privileged service accounts—an initial foothold into the enterprise, then AD, file servers, or backup systems.

Given Clop and LockBit's prior PaperCut tradecraft, this wave is assessed as likely tied to ransomware / double extortion. Respond as possibly already compromised, not just patch.

Remediation

Priority 1: Kill public exposure

• Immediately restrict the PaperCut Application Server Web interface (default 9191/9192) to trusted source IPs via firewall, host firewall, network ACL, VPN/zero-trust front door. This is the floor, always.
• Systems that cannot shrink exposure yet, patch per the table:

`NG v25 / v26  Windows / Linux / macOS  emergency patch (released 2026-08-28 02:10 AEST, includes SHA-256)
MF v25 / v26  Windows / Linux / macOS  emergency patch (same as above)
NG v24 / MF v24  emergency build in development; upgrade to v26 then apply the patch
`

Note: these emergency patches did not go through PaperCut's normal release process. Download only from the official PaperCut advisory link and verify SHA-256. Do not use unofficial mirrors.

Priority 2: Forensics and alerting

• Hunt IoCs on every PaperCut server. Focus on `pc-app.exe` parent process chains, missing/altered `server.log`, and the two error log lines above.
• Hosts with missing or truncated logs: assume compromise. Enter IR. Capture memory and disk images before remediation.
• Mirror PaperCut `server.log` and EDR events to SIEM so local log wipes do not blind you.

Priority 3: Defense in depth

• Move print servers off the flat network into a controlled VLAN/segment. Restrict outbound destinations and ports.
• Inventory PaperCut service-account privileges. Shrink to least privilege—especially directory services, backups, and SMB share write access.
• Register PaperCut assets (version, exposure, admin contacts) in IaC / CMDB. Do not wait for an incident to discover them.
• Rotate credentials on all user systems that may be in scope, especially enterprise accounts with PaperCut SSO.

References

• PaperCut emergency security advisory (vendor original)
• BleepingComputer: PaperCut warns of NG, MF flaw exploited in zero-day attacks
• FBI / CISA joint advisory: historical Clop and LockBit campaigns against PaperCut
• NVD: CVE-2023-27350 (historical comparable)