Affected Systems

PaperCut NG and MF print management software, all versions prior to Emergency Patch Release 3 (issued September 2026). Affects internet-facing Application Servers. Used by 100 million users across 70,000+ organizations including enterprises, government agencies, and educational institutions. Over 800 servers currently exposed online.

Exploitation Status

Active exploitation confirmed since August 29, 2026. Attackers chaining CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) to steal data from vulnerable servers. Threat intelligence honeypots observing exploitation targeting Derby database table dumps via hijacked external user-lookup feature. Threat actor attribution not yet published.

Business Impact

High-severity incident requiring immediate action for internet-facing PaperCut deployments. Attackers can bypass authentication and execute arbitrary code on print management servers, leading to database exfiltration. PaperCut's history of exploitation by ransomware gangs (LockBit, Clop, Bl00dy) and state-sponsored groups (Muddywater, APT35) increases risk of follow-on attacks including ransomware deployment or espionage. Print servers often contain sensitive document archives and user credentials. Emergency patches released in three iterations (Thursday, Friday, Tuesday) indicate evolving understanding of attack surface.

Urgency

🔴 Immediate

Recommended Actions

  • Apply PaperCut Emergency Patch Release 3 immediately to all internet-facing Application Servers, even if earlier emergency patches were installed
  • Review PaperCut-published indicators of compromise and search logs for authentication anomalies, external user-lookup abuse, and Derby database access patterns since August 29, 2026
  • Remove PaperCut NG/MF Application Servers from internet exposure where possible; implement VPN or zero-trust access controls for remote administration
  • Audit Print Archiving feature for unauthorized document access and review stored credentials in PaperCut databases for potential compromise
  • Monitor for lateral movement from compromised print servers and prepare incident response procedures given historical targeting by ransomware and APT groups