PaperCut NG/MF Zero-Days Exploited: What Offices Should Check Now

If your office copier makes people tap a badge before a print job comes out, or someone gets a monthly report of who printed what, there may be a print-management server running quietly in a closet or a virtual machine. If that server runs PaperCut NG or PaperCut MF, it just moved from "someday" to "this week" on your to-do list.

On August 27, PaperCut warned that attackers were actively exploiting its software. Emergency patches followed on August 28, and on Monday, August 31, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its catalog of known exploited vulnerabilities. Here's what happened, why it's really a network problem, and what to ask your copier dealer.

What happened with PaperCut last week?

Attackers found a way into PaperCut NG and MF servers before a fix existed, and PaperCut spent the rest of the week shipping emergency patches. In its urgent security advisory, PaperCut said it was investigating active exploitation affecting both products and had confirmed customer incidents, and it treated every NG and MF version as potentially affected. Help Net Security and The Register reported the warning as it unfolded.

The fixes didn't go smoothly. PaperCut released its first emergency patch on August 28 for versions 25 and 26. Researchers at watchTowr Labs found a way around it the same day, and a second emergency patch followed later on August 28 with extra hardening and coverage for version 24, according to SecurityWeek and watchTowr.

What are CVE-2026-81578 and CVE-2026-82078?

They're two separate flaws that attackers chain together to take over a PaperCut server without logging in.

• CVE-2026-81578 is an authentication bypass in PaperCut's web management interface. It lets an unauthenticated remote attacker change certain system settings. Arctic Wolf lists it as high severity, with a CVSS score of 8.8.
• CVE-2026-82078 is a critical flaw, scored 9.4, in PaperCut's database connection utilities. According to PaperCut's advisory, the software loads database driver classes by name without checking them against an allowlist, which lets an attacker run Java code as the PaperCut server process.

Chained, the two give an attacker remote code execution with no username or password, only the server's IP address or hostname, as Cybersecurity Dive and CISA describe.

In plain English: the first bug lets a stranger change a setting they should never be able to touch, and the second turns that setting into a way to run their own code.

Why does a hacked print server matter?

Because it isn't really a printer problem. A print-management server is an ordinary server inside your network, often connected to your user accounts and copiers. Once attackers control it, they're inside instead of knocking on the door.

By August 31 that was no longer theoretical. PaperCut's updated indicators of compromise show attackers setting up a Windows service called "Remote Access Service" that runs SimpleHelp's SimpleService.exe, then downloading AnyDesk, according to PaperCut's advisory and Help Net Security. Help Net Security described the pair as redundant access: remove one, and the other still works.

It's the pattern from our look at remote-access malware using printers as an entry point: the device nobody watches becomes the door nobody locks. Our printer security checklist covers the basics.

Which offices might run PaperCut without realizing it?

Any office where a copier dealer or IT provider set up print release, print-cost tracking or scan workflows, possibly without the owner ever hearing the software's name. Typical candidates:

• Law firms that bill printing back to client matters (see our law firm printer guide).
• Medical and dental offices that hold patient paperwork until the right person badges in (see our medical office printer guide).
• Accounting and tax practices that track print volume by client.
• Schools and training centers with student print quotas.

A system that was installed years ago and never revisited is exactly the one to worry about, because of the next point.

Is there a patch for my PaperCut version?

If you're on version 24, 25 or 26, yes. If you're on version 23 or earlier, no. PaperCut's advisory says there are no emergency patches or maintenance releases for version 23 or earlier, and those customers need to upgrade to a supported line (24, 25 or 26). Huntress and the Canadian Centre for Cyber Security report the same limitation.

For supported versions, the fix as of August 31 is the second emergency patch, Emergency Patch Release 2, which covers all three version lines, according to BleepingComputer and the Canadian Centre for Cyber Security.

CISA gave federal civilian agencies until September 14 to deal with both flaws, according to CISA's catalog entry and The Hacker News. Your business isn't bound by that deadline, but it's a fair yardstick: two weeks, not two quarters.

What this means for San Fernando Valley offices

For Valley law firms, medical and dental practices, accounting offices and schools, the risk is a print server nobody remembers, reachable from the internet, on a version nobody has updated. It doesn't matter whether you're in Woodland Hills or Burbank: attackers who need only an IP address don't care about ZIP codes, so the same checks apply across all the communities we serve.

There's also a California-specific reason not to wait. SB 446, enacted in October 2025, changed the state's breach-notification law: a business must now notify affected Californians within 30 calendar days of discovering a breach of their personal information. Before, the law required notice "without unreasonable delay" but set no fixed number of days. Delay is allowed for law-enforcement needs or to determine the breach's scope and restore the system, according to the bill text and The National Law Review. Law-firm coverage in JD Supra says the rule took effect January 1, 2026.

That clock applies only if personal information was actually breached; a compromised print server doesn't trigger it automatically. If yours handled customer or employee data, ask counsel early, and check what your cyber insurance policy expects after an incident.

What to do now

1. Find out whether you run PaperCut. Ask your copier dealer or IT provider this week: "Do we run PaperCut NG or MF, or any print-management server, anywhere?" Get the version number in writing.
2. Take the admin interface off the internet. If the PaperCut Application Server can be reached from the public internet, restrict web access to trusted IP addresses with firewall rules or network access controls. That's PaperCut's own first instruction, even if you've seen nothing suspicious.
3. Patch versions 24, 25 and 26 now. Apply PaperCut's latest emergency patch for your version line.
4. Upgrade version 23 or older. There is no patch for these versions. Schedule the upgrade to 24, 25 or 26 immediately, and keep the server isolated until it's done.
5. Look for unexpected remote-access tools. Have IT check the server for a Windows service named "Remote Access Service" running SimpleService.exe, an AnyDesk install nobody authorized, and the other indicators listed in PaperCut's advisory.
6. Treat any finding as an incident. Preserve logs, call your IT provider and cyber insurer, and talk to counsel about California's notification rules.
7. Patch print servers within days, the same as firewalls and remote-access software.

Not sure whether PaperCut, or any print-management software, is running in your office? Book a free virtual consultation and we'll help you find out what's installed, which version it is, and whether it can be reached from the internet.

Update (September 30, 2026)

The fixes have moved on. On September 1, PaperCut released a third emergency patch that fixed two problems the earlier patches caused (broken SAML single sign-on and legacy Microsoft SQL Server drivers for external card lookup), according to PaperCut's advisory, Arctic Wolf and eSentire. PaperCut then shipped fully tested maintenance releases 26.0.5, 25.0.13 and 24.1.10, which replace all the emergency patches; it advises anyone on an emergency-patch build to move to one, per PaperCut's release history and The Hacker News. PaperCut says that if you use an external database for card or ID lookup, it must be reconfigured after upgrading. Version 23 and earlier still have no fix.

The attacks also grew: threat-intelligence firm GreyNoise documented a campaign that compromised at least 440 PaperCut NG/MF instances at 395 organizations in 48 countries, as Help Net Security and SecurityWeek reported. If your server was internet-reachable before you patched, have it checked for compromise, not just updated.