● Covered by 4 sources · 11 reportsMedium impact9 negative2 neutral
PaperCut warns of active exploitation of zero-day vulnerability in NG and MF software
Key points
- PaperCut NG and MF software have a zero-day vulnerability.
- The vulnerability is actively exploited in attacks.
- Emergency patches are available for public-facing servers.
- Organizations should restrict web interface access to trusted IPs.
- Emergency patches are available for versions 25 and 26.
- Indicators of compromise include suspicious activity from "pc-app.exe".
- Missing, truncated, or deleted server.log files are indicators of compromise.
- Specific error entries in "server.log" indicate compromise: "ERROR No suitable driver found for jdbc:no:x" and "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST".
- The vulnerability has no CVE identifier yet.
- The vulnerabilities are tracked as CVE-2026-82078 and CVE-2026-81578.
- Both vulnerabilities have severity scores over 8.8 out of 10.
- The flaws allow attackers to gain initial access to corporate environments.
- The vulnerabilities allow unauthenticated remote code execution.
- Attackers can manipulate server configurations and execute arbitrary Java code.
- PaperCut released a second emergency security update.
- Initial fixes were bypassed by researchers.
- CVE-2026-81578 is an authentication bypass vulnerability.
- CVE-2026-81578 impacts the web management interface.
- Emergency patches are available for version 24.
- CVE-2026-82078 is a critical issue related to unsafe dynamic class loading.
- Attackers are deploying remote access tools.
- CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog.
- PaperCut warned users on August 27.
- WatchTowr researchers are monitoring the situation.
- The vulnerabilities impact over 70,000 organizations.
- PaperCut released emergency patches on Thursday and Friday.
- Defused observed exploit activity in honeypots since August 29th.
- PaperCut NG/MF versions 26.0.5, 25.0.13, and 24.1.10 are available.
- The new versions contain additional security hardening and mitigation.
- A suspected Russian-speaking actor targeted 395 organizations globally.
- The attacks primarily targeted the U.S. education sector.
- The vulnerabilities were exploited in AI-powered attacks.
- A Russian-speaking threat actor used AI to build, test, and deploy exploits.
- The threat actor targeted 440 PaperCut NG/MF deployments.
- The attacks aimed for remote code execution and credential harvesting.
- The threat actor avoided targeting entities in 28 identified countries.
Active Exploitation of PaperCut Vulnerability
PaperCut has issued an urgent security advisory confirming active exploitation of a zero-day vulnerability affecting all versions of its PaperCut NG and PaperCut MF print management software. The company stated it is aware of confirmed customer incidents and is treating the matter with high priority.
Mitigation and Patches
PaperCut released emergency patches for customers with public-facing PaperCut NG/MF servers. For organizations unable to apply patches immediately, the company recommends restricting access to the web interfaces of Internet-exposed PaperCut Application Servers to trusted IP addresses using firewall rules or network access controls.
Indicators of Compromise
PaperCut provided indicators of compromise (IoCs) to help administrators detect potential breaches. These include suspicious activity from the legitimate PaperCut pc-app.exe process, modified or missing server.log files, and specific error messages in server.log such as "ERROR No suitable driver found for jdbc:no:x" or "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST". However, the absence of these indicators does not guarantee a server has not been compromised.
Ongoing Investigation
At this time, PaperCut has not disclosed details about the attackers, the post-compromise activities, or whether data theft is occurring. The company stated it will continue to update its advisory with additional IoCs and remediation guidance as its investigation progresses.
Updates
- PaperCut NG/MF versions 26.0.5, 25.0.13, and 24.1.10 are available.
- The new versions contain additional security hardening and mitigation.
- A suspected Russian-speaking actor targeted 395 organizations globally.
- The attacks primarily targeted the U.S. education sector.
- The vulnerabilities were exploited in AI-powered attacks.
- A Russian-speaking threat actor used AI to build, test, and deploy exploits.
- The threat actor targeted 440 PaperCut NG/MF deployments.
- The attacks aimed for remote code execution and credential harvesting.
- The threat actor avoided targeting entities in 28 identified countries.
- The vulnerabilities impact over 70,000 organizations.
- PaperCut released emergency patches on Thursday and Friday.
- Defused observed exploit activity in honeypots since August 29th.
- Attackers are deploying remote access tools.
- CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog.
- PaperCut warned users on August 27.
- WatchTowr researchers are monitoring the situation.
- Emergency patches are available for version 24.
- CVE-2026-82078 is a critical issue related to unsafe dynamic class loading.
- PaperCut released a second emergency security update.
- Initial fixes were bypassed by researchers.
- CVE-2026-81578 is an authentication bypass vulnerability.
- CVE-2026-81578 impacts the web management interface.
- The vulnerabilities are tracked as CVE-2026-82078 and CVE-2026-81578.
- Both vulnerabilities have severity scores over 8.8 out of 10.
- The flaws allow attackers to gain initial access to corporate environments.
- The vulnerabilities allow unauthenticated remote code execution.
- Attackers can manipulate server configurations and execute arbitrary Java code.
- Emergency patches are available for versions 25 and 26.
- Indicators of compromise include suspicious activity from "pc-app.exe".
- Missing, truncated, or deleted server.log files are indicators of compromise.
- Specific error entries in "server.log" indicate compromise: "ERROR No suitable driver found for jdbc:no:x" and "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST".
- The vulnerability has no CVE identifier yet.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2023-273509.8 CRITICAL CVE CVE-2026-5823110.0 CRITICAL CVE CVE-2026-820789.4 CRITICAL CVE CVE-2026-815788.8 HIGH CVE CVE-2023-25338.4 HIGHHow outlets covered it
Two PaperCut NG/MF vulnerabilities (CVE-2026-82078 and CVE-2026-81578) were exploited in AI-powered attacks against 440 organizations globally, according to GreyNoise. A Russian-speaking threat actor used AI to rapidly build and deploy exploits for remote code execution and credential harvesting, compromising some environments in minutes. This demonstrates the increasing sophistication and speed of attacks leveraging AI in vulnerability exploitation.
PaperCut released new security maintenance versions (26.0.5, 25.0.13, 24.1.10) that replace previous emergency patches for two actively exploited vulnerabilities, CVE-2026-81578 and CVE-2026-82078. These flaws allow authentication bypass and arbitrary code execution, and have been used by a suspected Russian-speaking actor to target 395 organizations globally, primarily in the U.S. education sector.
Two security vulnerabilities in PaperCut NG and MF print management software, CVE-2026-81578 and CVE-2026-82078, are being actively exploited for data theft after being patched last week. These flaws allow attackers to bypass authentication and achieve remote code execution, impacting over 70,000 organizations using the software.
Exploitation of two PaperCut NG/MF vulnerabilities, CVE-2026-82078 and CVE-2026-81578, has escalated from reconnaissance to active intrusions, with attackers deploying remote access tools. These flaws allow unauthenticated attackers to bypass authentication and achieve remote code execution, prompting CISA to add them to its Known Exploited Vulnerabilities catalog.
PaperCut Software issued a second emergency patch for its NG and MF print management solutions after two zero-day vulnerabilities were found to be actively exploited. The flaws allow unauthenticated attackers to bypass authentication and achieve remote code execution, prompting additional hardening for versions 24, 25, and 26.
PaperCut issued a second emergency security update for its NG and MF print management software due to active exploitation of two vulnerabilities, CVE-2026-82078 and CVE-2026-81578, after initial fixes were bypassed. These flaws allow unauthenticated remote code execution and authentication bypass, affecting the web management interface and database connection utilities. The update addresses the continued risk to customer servers.
Malicious actors are exploiting two newly patched vulnerabilities in PaperCut NG and MF to achieve unauthenticated remote code execution. PaperCut has released an emergency fix with additional hardening to address these flaws, which allow attackers to manipulate server configurations and execute arbitrary Java code.
PaperCut issued an emergency advisory regarding active exploitation of two vulnerabilities, CVE-2026-82078 and CVE-2026-81578, in its NG and MF printer management software. These flaws, with severity scores over 8.8, allow attackers to gain initial access to corporate environments, posing a risk to organizations using the widely deployed software.
PaperCut Software issued emergency patches for its NG and MF print management solutions due to an actively exploited zero-day vulnerability. This flaw, for which no CVE has been assigned yet, is being used in confirmed customer incidents, prompting PaperCut to urge immediate patching and provide indicators of compromise.
A zero-day vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software is being actively exploited. PaperCut has released emergency patches for versions 25 and 26 and advises users to restrict internet access to their application servers immediately.
PaperCut issued an urgent security advisory regarding a zero-day vulnerability in all versions of its PaperCut NG and PaperCut MF print management software, which is actively being exploited in attacks. The company released emergency patches and advised organizations to restrict access to web interfaces of Internet-exposed servers, as this vulnerability poses a significant risk to affected systems.