PaperCut NG and PaperCut MF Zero-Days Actively Exploited

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Critical

Other

August 27, 2026

Executive Summary

Two zero-days actively exploited enable arbitrary Java code execution and unauthenticated configuration changes via authentication bypass.

Key Details

Affected Platform

Attack Surface

Network accessible, unauthenticated

Recommended Action

Affected Environment

PaperCut NG and PaperCut MF, all versions, print management servers exposed via web management interfaces.

Operational Impact

Full server compromise possible, followed by remote access tool installation, credential theft, and lateral movement across networks.

Technical Root Cause

Unsafe dynamic class loading in the database connector, plus improper access control enabling pre-authentication administrative actions.

Recommended Mitigation

Apply PaperCut mitigations immediately.
Monitor for indicators of compromise.
Restrict access to the management interface.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

PaperCut Security Bulletin, GitHub proof-of-concept repository.