U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog. 2026-09-01 11:09 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: PaperCut, the print management software running in schools, hospitals, and offices worldwide, recently confirmed that a pre-authentication remote code execution flaw, tracked as CVE-2026-81578, [...] Read the original article: U.S. U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco ISE and PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Cisco ISE and PaperCut NG/MF flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: This... Security Products & Services July 28, 2025 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Catalyst, Kentico Xperience, PaperCut NG/MF, Synacor ZCS, Quest KACE SMA, and JetBrains TeamCity flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Cisco Catalyst, Kentico Xperience, PaperCut NG/MF, Synacor ZCS, Quest KACE SMA, and JetBrains... April 21, 2026 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities affecting PaperCut NG and PaperCut MF to its Known... August 31, 2026 In "Cyber Security News"

Exploited PaperCut vulnerabilities: new details and security flaws. Post Views: 15 PaperCut Software has issued a second urgent update to address zero-day vulnerabilities being actively exploited in its NG and MF print management systems. Overview of the vulnerabilities. PaperCut Software has issued a second urgent update to address zero-day vulnerabilities being actively exploited in its NG and MF print management systems. The flaws allow unauthenticated attackers to bypass authentication mechanisms and execute arbitrary code remotely on affected systems. The vendor released a security advisory on August 27 and deployed the first emergency patch the following day for PaperCut NG/MF versions 25 and 26. A second update was released later that same day to address additional risks, including for version 24. Key vulnerabilities identified. CVE-2026-81578. One, tracked as CVE-2026-81578, is a high-severity authentication bypass that enables remote, unauthenticated users to alter specific system configurations. CVE-2026-82078. The second, CVE-2026-82078, involves unsafe dynamic class loading within database connection utilities. The advisory explained that compromising system configuration parameters could allow execution of arbitrary Java bytecode from the application classpath within the PaperCut server's security context. Security implications and response. Indicators of compromise (IoCs) related to the vulnerabilities have been published. Initial reports suggested a single flaw was being exploited, but subsequent analysis by PaperCut and security firms Huntress and WatchTowr confirmed two distinct zero-day vulnerabilities. WatchTowr identified multiple methods to bypass the initial patch and an additional authentication flaw, prompting the second update. Huntress confirmed attacks on at least two clients, with the first exploitation attempts detected on August 26. The firm reported that the activity centered on system reconnaissance, without evidence of secondary malware or further command-and-control interactions. Current status and recommendations. The identity of the attackers and their objectives remain unknown. However, prior incidents involving PaperCut vulnerabilities highlight the risks, as CISA's Known Exploited Vulnerabilities (KEV) catalog includes three other flaws, two of which have been linked to ransomware campaigns. ShadowServer Foundation data indicates approximately 1,000 PaperCut installations are accessible online, with the majority located in North America and Europe. The company continues to refine its advisory, emphasizing the need for immediate patching and monitoring for signs of compromise. Security teams are urged to review the provided IoCs and implement mitigations to prevent exploitation.

Attackers actively exploit flaws in PaperCut NG/MF. Vendor Issues Second Set of Emergency Patches for Printer Management Software Mathew J. Schwartz (euroinfosec) - August 31, 2026 Widely used print management software vendor PaperCut published two emergency patches as it battles attackers actively exploiting zero-day vulnerabilities in its tools. "PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing," the company said in an "urgent security advisory" to customers updated on Monday. The Australian company counts 100 million end users of its software, which is designed to facilitate self-management of printers and multi-function devices, including managing and tracking print queues. The company said the software is used for everything from large enterprise and university environments that may number over 100,000 users to smaller organizations that may facilitate printing for fewer than 50 users on just a handful of printers. "The vulnerabilities allow an unauthenticated attacker to bypass authentication and gain remote-code execution on affected instances. Patches are available, but in-the-wild exploitation is already happening," said cybersecurity firm watchTowr in a Friday LinkedIn post. The vulnerabilities appear to affect all versions of PaperCut NG and MF Application Server. PaperCut on Thursday issued emergency patches for versions 25 and 26, followed Friday by an updated set of patches that also extended coverage to version 24, first released in October 2024. The company released indicators of compromise resulting from in-the-wild attacks that organizations can use to hunt for signs that they've been breached. Cybersecurity firm Huntress on Friday said that nearly half of the roughly 2,500 installations of PaperCut that it tracks were running version 23 - released in October 2023 - or older, for which no patches are available. PaperCut told customers it recommends they upgrade their software. Additional mitigation advice from PaperCut is that any organization that makes any version of the software accessible using the public internet should "immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses)," as well as "use firewall rules, network access controls or equivalent measures to ensure the PaperCut server's web interfaces cannot be reached from untrusted internet addresses." The company's patches address two flaws in the software: CVE-2026-82078, an unsafe dynamic class loading in database connector with a critical CVSS score of 9.4, and CVE-2026-81578, an improper access control vulnerability which exists in the software's web management interface with a high CVSS score of 8.8. After shipping a first batch of patches Thursday, the company on Friday released "Emergency Patch Release 2," which it has advised all customers to install, even if they already installed the first patch. The company said the second patch release "includes additional hardening beyond the original emergency patch," gleaned in part thanks to efforts by researchers at Huntress and watchTowr, and it would help to better protect customers who couldn't mitigate the vulnerabilities by not making their PaperCut software public facing. WatchTowr said that after PaperCut first disclosed the flaws Thursday, it was able to reproduce the vulnerabilities as well as find "multiple patch bypasses," including "an additional authentication bypass vulnerability," all of which it's shared with PaperCut. Huntress said it's also created a working proof-of-concept exploit based on the vulnerabilities, and found at least two of its customers have been targeted with exploits for the flaws, one of them on Wednesday. "Post-exploitation activity included base64-encoded commands executed on the targeted server that decoded to commands whoami and ver that aimed to identify the victim's user account and operating system," it said. These aren't the first serious flaws to be found in PaperCut's printer management software. The catalog of known exploited vulnerabilities maintained by the U.S. Cybersecurity and Infrastructure Security Agency features multiple PaperCut NG/MF vulnerabilities, including CVE-2023-27350, an improper access control vulnerability added in 2023 when it was being targeted by ransomware-wielding attackers, as well as CVE-2023-2533, a cross-site request forgery vulnerability added in 2025. On April 20, CISA also added to its KEV catalog CVE-2023-27351, an improper authentication vulnerability in PaperCut NG/MF. The agency warned at the time that the flaw was already being actively exploited by ransomware-wielding attackers.