PaperCut Vulnerability: Patch Office Print Servers

If your office still prints invoices, charts, or patient packets, a PaperCut vulnerability is not someone else's problem. PaperCut NG and MF sit in front of many office printers. This week the vendor confirmed attackers are using two flaws to take over those servers without a login.

That matters now because the first emergency fix was not enough. On Friday, August 28, PaperCut shipped a second emergency patch after researchers found ways around the original update. Huntress also reported real customer incidents. For a Sarasota or Bradenton small business, the window is this weekend, not next month's "IT day."

What happened

PaperCut sells print-management tools used by schools, clinics, law offices, and shops that bill for pages. It warned that attackers were exploiting NG and MF in live attacks, then shipped a first emergency update on August 27 after a university customer and its forensics team handed over evidence.

By August 28 the bugs had names: CVE-2026-81578 and CVE-2026-82078. One lets an outsider reach admin functions in the web console before the software finishes checking who they are. The second lets that outsider run code on the server if they can change a setting. Together, that is access without a password.

Researchers at watchTowr and Huntress reproduced the chain. Huntress saw it in two customer environments. The activity looked like scouting, not a finished ransomware drop: commands that ask who the service is running as and which Windows version is on the box.

The first patch left gaps. Huntress found bypasses and another authentication hole and sent them to PaperCut. Emergency Patch Release 2 is the build with that extra hardening. Install it even if Thursday's fix is already on the server.

Release 2 covers NG and MF versions 24, 25, and 26 on Windows, Linux, and Mac. Site servers and secondary print servers need it too. Print Deploy and Mobility Print are not in this advisory. Version 23 and older do not get a bandage; those shops need a current release. PaperCut also repeated the obvious control: keep the web admin page off the public internet.

This is not a new pattern. In 2023 a different PaperCut bug, CVE-2023-27350, was used by ransomware crews including Clop and LockBit. Printer software is boring until it is the door into payroll and scanned records.

How it affects your business

You may not think you "have PaperCut." Check anyway. Many offices inherit it from a copier lease, a school-district hand-me-down, or a print vendor who set it up years ago and never came back. The server is often a leftover Windows box in a closet that also stores scanned PDFs.

If that box is reachable from the internet, an attacker does not need to phish your bookkeeper first. They talk to the print console, run code as the PaperCut service, then look around. From there they can read files or move toward accounting software on the same network.

Even if the server is only on the office LAN, a laptop on guest Wi-Fi can be enough when the network is flat. Small offices in Bradenton often share one switch for printers, cameras, and the front-desk PC. That convenience is how a print server becomes a beachhead.

Print queues hold tax returns, settlement drafts, lab results, and invoices. A compromised server can copy those jobs or stop printing altogether. If you cannot release charts on Monday, the technical problem is an operations problem.

CISA's guidance for small and medium businesses matches what we walk through on site visits: know what is on the network, limit who can reach admin pages, patch when a vendor says "emergency," and watch the logs after you do. Closet servers do not apply updates by themselves.

What to do

You do not need a war room. You need a Saturday checklist.

1. Confirm whether you run PaperCut NG or MF. Ask the copier vendor. Look for a PaperCut login on an office server or a badge-release station.

2. Install Emergency Patch Release 2, not the first hotfix. Use PaperCut's 27 August 2026 security advisory. Patch the application server and every site or secondary print server. Version 23 and older need an upgrade, not a waiting list.

3. Take the admin page off the public internet today. If you can open the console from a phone on cellular data, restrict it to office IPs or a VPN.

4. Look for signs someone already visited. Watch the pc-app.exe process, missing or chopped server.log files, and errors about a missing database driver or a strange cardID lookup. If logs are gone, look closer.

5. Keep guest Wi-Fi away from the print server. Printers do not need a path to every PC and backup box.

6. Do not park the only backup on that closet PC. If QuickBooks or the scan folder lives next to PaperCut, a compromise can take both. Keep a separate copy you have restored once. Our ransomware defense playbook is the longer version of that habit.

7. Assign an owner. Write the version, the patch date, and who may log into the console.

If that list is more than your team can finish between jobs, that is the signal. Managed IT is how we keep patch nights from becoming incident nights. If you want a human to check whether PaperCut is exposed and whether Release 2 actually landed, contact us and tell us what the copier vendor installed.

The PaperCut vulnerability will get a quieter headline next week. The servers in local closets will not patch themselves. Spend an hour now so Monday is about clients, not a print queue that suddenly belongs to someone else.

---

Source: fallback from the Hacker News queue (no story met the 48-hour / 100-point bar). Original reporting: PaperCut releases second emergency patch for exploited flaws on BleepingComputer. Vendor detail: PaperCut urgent security advisory. Additional context from Huntress.