PaperCut NG and PaperCut MF Zero-Days Actively Exploited

Affected Environment
PaperCut NG and PaperCut MF, all versions, print management servers exposed via web management interfaces.

Threat Overview
Two zero-days actively exploited enable arbitrary Java code execution and unauthenticated configuration changes via authentication bypass.

Exposure Timeline
Active exploitation confirmed in the wild; no official patch available yet, requiring urgent mitigation and monitoring now.

Attack Surface
PaperCut web management interface and database connection utilities, reachable by unauthenticated remote attackers over the network.

Technical Root Cause
Unsafe dynamic class loading in the database connector, plus improper access control enabling pre-authentication administrative actions.

Exploitation Pathway
Attacker manipulates driver configuration to load arbitrary Java bytecode, then deploys remote access tooling via PowerShell.