Listen to this Post
A Quiet Print Server Problem Becomes a Serious Security Emergency
Print infrastructure rarely receives the same attention as cloud platforms, identity systems, or internet-facing applications. Yet PaperCut NG and MF servers can sit deep inside an organization’s network, process sensitive documents, maintain user information, and interact with databases and authentication systems. That makes the latest PaperCut vulnerabilities far more dangerous than their “print management” label might suggest.
Two flaws, tracked as CVE-2026-81578 and CVE-2026-82078, were patched by PaperCut after being exploited as zero-days. The situation has now escalated: attackers are actively abusing the vulnerabilities to steal information from exposed servers rather than simply demonstrating remote code execution.
The development is particularly concerning because PaperCut says its software is used by roughly 100 million users across more than 70,000 organizations, including businesses, government agencies, and educational institutions.
For defenders, this is another reminder of a lesson repeated throughout the modern cybersecurity landscape: a vulnerability does not become safe simply because a patch exists. If attackers discovered it first, organizations must assume that some systems may already have been compromised.
What Happened to PaperCut NG and MF?
The two vulnerabilities can be chained together to create a particularly dangerous attack path. According to the supplied report, attackers can use them to bypass authentication and ultimately obtain remote code execution on vulnerable PaperCut NG and MF servers.
PaperCut Software responded with emergency patches released on Thursday and Friday. The company also published indicators of compromise intended to help administrators identify malicious activity.
But patching the software is only half the battle.
When a vulnerability has already been exploited as a zero-day, security teams have to answer a much harder question: Was the server compromised before it was patched?
Attackers Are Choosing Data Theft Over the Flashier RCE Route
Threat intelligence company Defused reported that exploitation was already appearing in its honeypots by August 29, 2026.
What makes the activity especially interesting is that attackers do not appear to be following the most obvious publicly discussed route.
Instead of immediately pursuing remote code execution, the observed actor abused the authentication bypass to manipulate PaperCut’s external user-lookup functionality and extract database information.
Defused described attackers dumping database tables through Apache Derby, indicating that the campaign is focused on information theft.
That distinction matters.
An attacker does not always need a dramatic ransomware deployment or an interactive shell to cause significant damage. If a compromised print-management server contains usernames, configuration information, printing records, document metadata, or other organizational data, database extraction alone can provide valuable intelligence.
Why PaperCut Servers Are Attractive Targets
PaperCut servers occupy an unusual position in corporate networks.
They are designed to understand users, printers, print jobs, authentication relationships, document workflows, and administrative configurations. In many organizations, the software effectively sits at the intersection of users, endpoints, servers, and sensitive documents.
That creates an attractive target for threat actors.
A compromised PaperCut server could potentially provide attackers with information useful for:
Identifying employees and accounts.
Mapping organizational structures.
Discovering printer infrastructure.
Learning about internal systems.
Extracting application databases.
Gathering information about print activity.
Identifying high-value users.
Establishing a foothold for additional attacks.
Preparing for ransomware deployment.
Conducting espionage or intellectual-property theft.
The important point is that the print server itself may not be the final target.
More Than 800 PaperCut Servers Are Exposed Online
Shadowserver is currently tracking more than 800 PaperCut NG and MF servers exposed to the internet.
That number should not automatically be interpreted as 800 compromised systems. Some systems may be honeypots, some may already be patched, and others may have compensating security controls.
Nevertheless, internet exposure creates a dangerous situation when a vulnerability is both remotely exploitable and actively abused.
The longer vulnerable systems remain accessible, the greater the opportunity for automated scanning and exploitation.
PaperCut Has a Troubling History With Exploitation
This is not the first time PaperCut vulnerabilities have attracted serious threat actors.
In 2023, attackers exploited CVE-2023-27350, a critical remote code execution vulnerability, together with CVE-2023-27351, an information disclosure vulnerability.
The campaign was associated with ransomware activity involving LockBit and Clop.
Microsoft later reported that Iranian state-backed groups including MuddyWater and APT35 had also begun exploiting the vulnerabilities.
This history changes the way defenders should interpret the current incident.
PaperCut vulnerabilities are not merely theoretical weaknesses waiting for researchers to publish proof-of-concept code. Previous flaws have already demonstrated their value to both financially motivated criminals and state-linked operators.
Print Archiving Has Previously Created an Attack Opportunity
One particularly dangerous PaperCut feature highlighted in previous attacks was Print Archiving.
The feature exists for legitimate business purposes: organizations can use it to retain copies of documents sent through printing infrastructure.
But from an
This illustrates a broader cybersecurity problem.
A feature designed to improve visibility or compliance can become extremely valuable to attackers if the system protecting that feature is compromised.
Ransomware Groups Have Already Used PaperCut as Initial Access
In May 2023, the FBI and CISA warned that the Bl00dy ransomware operation had begun exploiting CVE-2023-27350 for initial access.
The lesson is straightforward: PaperCut servers can serve as a gateway into broader attacks.
Once an attacker compromises an internet-facing application, the next objective may be credential theft, lateral movement, privilege escalation, ransomware deployment, or data exfiltration.
That makes
It could represent the final objective—or simply the reconnaissance and collection stage of something larger.
CISA Has Continued to Track PaperCut Exploitation
Another PaperCut remote code execution vulnerability, CVE-2023-2533, was added to CISA’s Known Exploited Vulnerabilities catalog in July 2025.
The recurring appearance of PaperCut vulnerabilities in real-world exploitation is a strong signal for security teams.
Organizations should not treat PaperCut as a low-priority infrastructure component simply because it is associated with printers.
Internet-facing management software is still attack surface.
The Biggest Danger May Be What Happened Before the Patch
One of the most important aspects of this incident is the timing.
When a vulnerability is exploited as a zero-day, defenders may have little or no warning before the vendor publishes a patch.
That creates a window in which attackers can enter systems while administrators still believe their software is secure.
Installing the emergency update closes the vulnerability going forward.
It does not automatically remove:
Stolen credentials.
Backdoors.
Persistence mechanisms.
Extracted databases.
Modified configurations.
Web shells.
Scheduled tasks.
New administrator accounts.
Malware.
Attacker-created API tokens.
Exfiltrated information.
For that reason, organizations should treat emergency patching and incident response as two separate tasks.
Deep Analysis
Start With Asset Discovery
Security teams should first determine where PaperCut NG and MF are installed and which systems are externally reachable.
On Linux environments, administrators can begin with basic process and network inspection:
ps aux | grep -i papercut
Then inspect listening services:
sudo ss -tulpn
And review recent network connections:
sudo ss -antp
The objective is not to prove compromise with these commands. It is to establish what the server is doing and whether it exposes unexpected services.
Search for Suspicious Authentication Activity
Because the current exploitation reportedly involves an authentication bypass, authentication logs deserve particular attention.
Administrators should investigate unusual authentication events around the period before and after exploitation became known.
For Linux systems, basic searches may include:
sudo grep -Ri "authentication" /var/log 2>/dev/null
And:
sudo grep -Ri "login" /var/log 2>/dev/null
The exact PaperCut logging locations vary according to deployment and version, so defenders should prioritize the vendor’s current forensic guidance and their organization’s SIEM data.
Investigate Database Access
The reported attacks are particularly notable because the threat actor allegedly used the PaperCut external user-lookup functionality and Derby database access to dump tables.
That means database activity deserves special scrutiny.
Security teams should look for:
Unexpected database queries
Unusual administrative requests
Large database reads
Abnormal outbound traffic
Unexpected access to user-related tables
Requests originating from unfamiliar IP addresses
Repeated authentication failures followed by successful access
Large amounts of database extraction from a print-management server should be treated as a potentially serious incident.
Inspect Outbound Connections
A compromised server frequently needs to communicate with infrastructure controlled by the attacker.
Administrators can inspect current connections with:
sudo lsof -i -n -P
and:
sudo ss -tunap
Look for connections to unfamiliar external addresses, particularly those that appeared suddenly after the suspected exploitation window.
Historical firewall, proxy, DNS, and NetFlow data can be even more valuable because attackers may already have disconnected.
Examine Processes and Persistence
After applying the vendor patches, investigate whether attackers established persistence.
Useful Linux checks include:
ps aux --forest
sudo crontab -l
sudo systemctl list-timers
sudo systemctl list-units --type=service
On Windows-based deployments, defenders should review services, scheduled tasks, PowerShell activity, newly created accounts, registry persistence, and endpoint detection telemetry.
Look Beyond the PaperCut Server
Perhaps the biggest mistake would be investigating only the affected application.
If an attacker gained access to a PaperCut server, security teams should consider whether credentials or network information obtained from that system could have been used elsewhere.
Review:
Identity-provider authentication
VPN activity
Remote desktop connections
SMB activity
Privileged account usage
Lateral movement alerts
Endpoint detection events
Cloud authentication
Administrative account changes
Large outbound transfers
A print server may be the entry point rather than the destination.
Why This Attack Is More Serious Than It Looks
Data Theft Can Be More Valuable Than Ransomware
Ransomware is visible.
Data theft can remain invisible for weeks or months.
An attacker quietly extracting databases may be gathering information for espionage, extortion, credential attacks, business-email compromise, or a future ransomware operation.
The absence of encrypted files should therefore never be interpreted as evidence that an incident is harmless.
Attackers Are Becoming More Selective
The reported PaperCut activity also demonstrates how attackers can adapt their behavior.
A public discussion may emphasize remote code execution, but an attacker does not necessarily need to follow that path.
If authentication bypass plus database access provides enough information to achieve the attacker’s objective, there is little reason to create additional noise by launching a full remote shell.
This is an important evolution in defensive thinking.
Security teams should monitor what an attacker can accomplish, not merely whether they used the most famous exploit path.
Internet-Facing Administrative Software Is a High-Value Target
Organizations have historically focused perimeter defenses around major applications such as VPN gateways, firewalls, email servers, and web applications.
Print-management platforms increasingly deserve the same scrutiny.
Any application that:
Is exposed to the internet,
Handles authentication,
Stores organizational information,
Runs with elevated privileges, or
Communicates with internal systems
should be considered part of the
What Organizations Should Do Now
Patch Immediately
The first priority is to install the latest PaperCut NG/MF security updates provided by PaperCut Software.
Do not delay emergency remediation simply because the organization has not observed suspicious activity.
Zero-day exploitation means the absence of an alert is not proof of safety.
Remove Unnecessary Internet Exposure
If PaperCut does not need to be directly accessible from the public internet, place it behind appropriate network controls.
Possible defensive measures include:
VPN access
Zero-trust access controls
IP allowlisting
Reverse proxies
Network segmentation
Firewall restrictions
Strong authentication
Monitoring and rate limiting
Reducing exposure limits the number of systems attackers can reach automatically.
Assume Compromise When Evidence Exists
If logs show suspicious activity before the system was patched, organizations should move beyond simple remediation.
The server should be investigated as a potentially compromised host.
Depending on the evidence, that may involve:
Isolating the server.
Preserving forensic evidence.
Resetting potentially exposed credentials.
Reviewing administrator accounts.
Searching for persistence.
Checking outbound traffic.
Reviewing database access.
Investigating lateral movement.
Monitoring related endpoints.
Hunt Across the Environment
Security teams should search their SIEM and EDR platforms for PaperCut-related activity and unusual network behavior.
The investigation should cover the period beginning before the emergency patches were released, because exploitation may have occurred before defenders knew the vulnerabilities existed.
What Undercode Say:
- PaperCut Should Be Treated as Security Infrastructure
The industry needs to stop treating print-management systems as harmless office utilities.
Modern PaperCut deployments can sit directly in the path of authentication, document workflows, databases, and internal networks.
That makes them security-sensitive infrastructure.
2. Zero-Day Exploitation Changes the Response
A normal vulnerability can often be handled through patch management.
A zero-day requires vulnerability management plus threat hunting.
The difference is enormous.
3. Patching Does Not Equal Recovery
Installing the update prevents future exploitation of the vulnerable code.
It does not erase evidence of previous intrusion.
Organizations must distinguish remediation from incident response.
4. Data Theft Deserves More Attention
Cybersecurity reporting often focuses on RCE because remote code execution sounds dramatic.
But database theft can be equally damaging.
A successful attacker may never need to execute ransomware.
- The Derby Database Is an Important Investigative Area
The reported use of Derby database dumping makes database monitoring particularly relevant.
Large or unusual database reads should receive immediate attention.
6. Internet Exposure Multiplies Risk
Every publicly accessible PaperCut server becomes a potential target for automated scanning.
Attackers do not need to know which organization they are targeting initially.
They can scan first and decide later.
7. Previous Campaigns Are a Warning
PaperCut has already been exploited by ransomware operators and state-linked groups.
History suggests that new vulnerabilities will continue attracting sophisticated attackers.
8. Defenders Should Expect Adaptation
Once researchers publish technical details, attackers frequently modify their exploitation strategies.
A security team should therefore monitor behavior rather than search only for one specific exploit signature.
9. Print Servers Can Become Intelligence Sources
User information, printing records, configuration details, and document-related data can all help attackers understand an organization.
The server may reveal more than defenders expect.
- Ransomware May Not Be the First Stage
An attacker could steal information today and return later.
That makes historical investigation essential.
11. Credentials Are Especially Important
If attackers gain access to user or administrative information, defenders should evaluate whether credentials could have been exposed.
Credential rotation may be necessary depending on forensic findings.
12. Network Segmentation Matters
A print server should not have unrestricted access to every internal system.
Segmentation can dramatically limit the consequences of a successful compromise.
13. Least Privilege Is Still Powerful
Reducing the privileges available to application services can restrict attacker movement.
No single security measure will stop every exploit, but privilege boundaries can reduce blast radius.
14. External Exposure Should Be Justified
Every internet-facing service should have a business reason for being publicly reachable.
If there is no compelling reason, remove the exposure.
15. Security Teams Need Better Asset Visibility
You cannot patch a server you do not know exists.
Asset discovery remains one of the most underrated parts of vulnerability management.
16.
More than 800 exposed systems represent a meaningful defensive signal.
Even if some are already patched or otherwise protected, the exposure demonstrates that vulnerable infrastructure can remain discoverable.
17. Vendors Need Rapid Disclosure
Emergency patches are essential, but defenders also need sufficient forensic information to determine whether exploitation occurred.
Indicators of compromise are therefore extremely valuable.
18. Customers Need Clear Incident Guidance
When a vulnerability has been exploited as a zero-day, customers need to know more than the fixed version.
They need to know what attackers were observed doing.
19. Authentication Bypasses Are Dangerous
Authentication bypass vulnerabilities deserve immediate attention because they can invalidate otherwise strong access-control policies.
An attacker may not need legitimate credentials at all.
20. Database Access Can Be the Prize
RCE is not necessarily the ultimate objective.
For information-focused attackers, direct access to structured application data may be more useful.
21. Security Monitoring Must Follow the Data
If sensitive data is stored in a particular system, defenders should monitor access to that data.
This is often more valuable than simply watching for malware.
22. Honeypots Are Providing Early Warning
The Defused observations demonstrate how honeypot infrastructure can reveal exploitation activity quickly.
Defensive deception remains valuable against automated campaigns.
23. Exploitation Can Become Automated
Once vulnerable PaperCut installations are identified, attackers can potentially automate parts of discovery and exploitation.
This compresses the time available for defenders.
24. Exposure Windows Are Becoming Smaller
Modern vulnerability campaigns can move from disclosure to widespread exploitation extremely quickly.
Organizations need emergency patching procedures that work outside normal maintenance cycles.
25. Vulnerability Management Must Become Risk-Based
Not every vulnerability requires the same response.
An actively exploited authentication-bypass/RCE chain on an internet-facing server deserves immediate priority.
26. Old Vulnerabilities Still Matter
The history of CVE-2023-27350 and other PaperCut vulnerabilities shows why defenders must not assume that older flaws have disappeared from the threat landscape.
Unpatched legacy systems remain attractive.
27. Attackers Learn From Previous Campaigns
Threat actors understand what PaperCut can provide.
Previous attacks demonstrated the value of print infrastructure.
That knowledge can influence future campaigns.
28. Government Agencies Are Not Immune
PaperCut’s presence in public-sector environments increases the potential consequences of successful exploitation.
Government networks should treat affected systems as high-priority assets.
29. Schools Are Also Attractive Targets
Educational organizations frequently operate large distributed environments with valuable user information.
Print infrastructure can become another path into those environments.
30. Small Organizations Are Not Safe
Attackers often scan the internet broadly.
A smaller organization can be compromised simply because it happens to expose a vulnerable server.
31. Security Teams Should Investigate Backward
When a zero-day is disclosed, analysts should investigate activity from before disclosure.
That is where evidence of initial compromise may exist.
32. Outbound Traffic Can Reveal the Story
Even when application logs have been deleted or modified, network telemetry may reveal unusual data transfers.
Firewall and proxy logs can become critical forensic evidence.
33. Database Dumps Create Patterns
Large data extraction can produce unusual access patterns.
Security analytics should be configured to detect abnormal database behavior.
34. Compromise Can Become a Supply-Chain Problem
If one PaperCut server connects to many internal systems, compromising it can provide attackers with a bridge toward other assets.
The blast radius depends heavily on architecture.
- Security Architecture Matters as Much as Patching
A fully patched server with excessive network privileges can still represent unnecessary risk.
Defense in depth remains essential.
36. Emergency Patching Needs Ownership
Organizations should know exactly who is responsible for PaperCut systems.
Unclear ownership causes dangerous delays.
37. IT and Security Must Cooperate
Print infrastructure is often managed by IT teams while security teams monitor broader threats.
The two groups need a shared response process.
38. Assume Attackers Will Try Again
The existence of previous successful PaperCut campaigns makes future exploitation highly plausible.
Organizations should treat this as an ongoing risk rather than a one-time event.
39. Visibility Beats Assumptions
The most dangerous statement during an incident is often, “We don’t think it happened.”
Security teams need evidence.
40. The Bigger Lesson Is Simple
PaperCut demonstrates how a seemingly ordinary enterprise application can become a high-value attack surface.
The modern defender has to secure everything that connects users, data, applications, and networks—not just the systems traditionally labeled “security critical.”
✅ The Two Vulnerabilities Are Reported as CVE-2026-81578 and CVE-2026-82078
The supplied article identifies these two vulnerabilities as affecting PaperCut NG and MF and says they were patched after zero-day exploitation.
The report further describes them as a chain capable of bypassing authentication and reaching remote code execution.
✅ Active Exploitation Is Reported
Defused reportedly observed exploitation activity in honeypots beginning August 29, 2026.
The observed activity was described as focused on database theft rather than simply following the public RCE exploitation path.
✅ PaperCut Has a History of Being Exploited
Previous PaperCut vulnerabilities, including CVE-2023-27350, were exploited by criminal and state-linked threat actors.
That historical context makes the current incident especially significant for organizations operating PaperCut infrastructure.
⚠️ Exposure Does Not Mean Compromise
The reported figure of more than 800 internet-exposed PaperCut servers should not be interpreted as 800 compromised organizations.
Some systems may be patched, protected, honeypots, or otherwise inaccessible to attackers.
Prediction
(+1) Emergency Patching Will Rapidly Reduce the Number of Vulnerable PaperCut Servers
The strongest positive prediction is that organizations will move quickly to install the emergency updates and reduce direct internet exposure.
Security teams are increasingly aware that actively exploited vulnerabilities require action outside traditional maintenance schedules.
(+1) Threat Hunting Will Become the Next Major Phase
As more organizations patch PaperCut, attention will shift from vulnerability remediation to determining whether attackers already accessed affected systems.
This could uncover additional compromised servers that were silently exploited before the emergency fixes became available.
(-1) Some Unpatched Servers Will Remain Exposed
Despite emergency warnings, vulnerable enterprise applications frequently remain online because of outdated infrastructure, forgotten deployments, limited IT resources, or incomplete asset inventories.
Those systems could become targets for automated exploitation.
(-1) Data Theft Could Precede Larger Intrusions
The current focus on database extraction raises the possibility that some attackers are collecting information before attempting broader compromises.
Organizations that treat the incident as “just a print-server vulnerability” could underestimate the consequences.
(+1) Network Segmentation Can Limit the Damage
Organizations that isolate print-management systems and restrict their access to sensitive internal resources should be better positioned to contain successful exploitation.
The PaperCut incident reinforces why segmentation remains one of the most practical defenses against application compromise.
The Warning Hidden Inside the Printer Room
The most uncomfortable lesson from this incident is that cybersecurity does not care what an application was originally designed to do.
A printer server may look like a mundane piece of office infrastructure. But once it handles authentication, user information, databases, documents, and connections to internal systems, it becomes part of the organization’s security boundary.
The PaperCut vulnerabilities show how quickly that boundary can be crossed.
With active exploitation reportedly targeting CVE-2026-81578 and CVE-2026-82078, organizations should not stop at installing the emergency patches. They should investigate exposure, review logs, hunt for suspicious database activity, inspect outbound connections, evaluate credentials, and determine whether the affected server was compromised before remediation.
The real danger is not simply that attackers can break into a print server.
It is that they may be able to turn that quiet server into a source of organizational intelligence—and potentially a doorway into everything behind it.
▶️ Related Video (82% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.stackexchange.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
