PaperCut warns of active exploitation of zero-day vulnerability in NG and MF software

Active Exploitation of PaperCut Vulnerability

PaperCut has issued an urgent security advisory confirming active exploitation of a zero-day vulnerability affecting all versions of its PaperCut NG and PaperCut MF print management software. The company stated it is aware of confirmed customer incidents and is treating the matter with high priority.

Mitigation and Patches

PaperCut released emergency patches for customers with public-facing PaperCut NG/MF servers. For organizations unable to apply patches immediately, the company recommends restricting access to the web interfaces of Internet-exposed PaperCut Application Servers to trusted IP addresses using firewall rules or network access controls.

Indicators of Compromise

PaperCut provided indicators of compromise (IoCs) to help administrators detect potential breaches. These include suspicious activity from the legitimate PaperCut pc-app.exe process, modified or missing server.log files, and specific error messages in server.log such as "ERROR No suitable driver found for jdbc:no:x" or "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST". However, the absence of these indicators does not guarantee a server has not been compromised.

Ongoing Investigation

At this time, PaperCut has not disclosed details about the attackers, the post-compromise activities, or whether data theft is occurring. The company stated it will continue to update its advisory with additional IoCs and remediation guidance as its investigation progresses.