Affected Systems

All versions of PaperCut NG and PaperCut MF print management software. Primary risk: Internet-exposed Application Servers with public-facing web interfaces.

Exploitation Status

Active exploitation confirmed. PaperCut reports confirmed customer incidents. Vulnerability reproduced by vendor. No CVE assigned yet. Technical details and attacker identity not disclosed.

Business Impact

Organizations with Internet-exposed PaperCut servers face immediate risk of compromise. Historical PaperCut exploitation (CVE-2023-27350) led to Clop, LockBit, and Bl00dy ransomware attacks, with threat actors using access for network lateral movement. Current attack scope, data theft, and post-exploitation activity unknown. Education sector and enterprises using print management are primary targets.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately restrict PaperCut NG/MF web interface access to trusted IP addresses using firewall rules or network ACLs if servers are Internet-exposed
  • Apply emergency patches released by PaperCut for public-facing servers; check vendor advisory for download links and installation guidance
  • Search server.log files for indicators: 'ERROR No suitable driver found for jdbc:no:x' and 'ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST'
  • Monitor for suspicious activity from legitimate pc-app.exe process and check for modified, deleted, or missing server.log files
  • Assume compromise if IOCs are absent but server was Internet-exposed; conduct forensic investigation and review authentication logs for unauthorized access