PaperCut Under Attack: Zero-Day Exploited, Emergency Patch, and Order to Isolate Servers

On August 28, 2026, PaperCut Software reported a zero-day vulnerability in its print management products PaperCut NG and PaperCut MF that is already being exploited in real-world attacks. The flaw does not yet have a CVE identifier, and the vendor has not released technical details. However, it has confirmed verified incidents at customer sites and has issued emergency patches, urging immediate installation.

The company also recommends disconnecting PaperCut Application Servers from the internet and restricting access to trusted IP addresses only. Even in the absence of suspicious activity, web interfaces should be protected with firewall rules or equivalent network controls.

The investigation is ongoing: the security bulletin will be updated with indicators of compromise and remediation guidance as soon as verified information becomes available.

A Flaw Without Details, but with Confirmed Exploitation

At this time, the exact versions affected by the new zero-day are unknown. PaperCut has not provided the attack vector, severity, or attribution. What is certain is that the vulnerability is already being used against real infrastructures: the vendor refers to “verified incidents” at customer sites.

The recommendation to isolate internet-exposed servers is a strong signal. This is not a generic preventive measure, but an operational request directed at anyone managing a PaperCut Application Server accessible from the outside. The advice applies even where no suspicious activity has been observed: attackers may already have taken control without leaving obvious traces.

Emergency patches were distributed on Friday (the exact date has not been disclosed), and the vendor urges immediate installation. Those who cannot update right away should at least restrict web access to internal or trusted IP addresses only.

The Two Previous CVEs: Authentication Bypass and Ransomware

The new flaw fits into an already known pattern. PaperCut has been targeted by at least two critical vulnerabilities documented in 2023, both listed in CISA’s KEV catalog and exploited in ransomware campaigns.

The first, CVE-2023-27350, has a CVSS score of 9.8. It allows a remote attacker to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). The flaw resides in the SetupCompleted class and is caused by improper access control (CWE-284). Exploitation can lead to arbitrary code execution in the SYSTEM context, the highest privilege level on Windows. CISA added it to KEV on April 21, 2023, with a remediation deadline for U.S. federal agencies set for May 12, 2023.

The second, CVE-2023-27351, has a CVSS score of 7.5. It also allows authentication bypass, but the impact is limited to information disclosure (high confidentiality, integrity and availability unaffected). The flaw lies in the SecurityRequestFilter class and stems from improper implementation of the authentication algorithm (CWE-287). CISA added it to KEV on April 20, 2026, with a deadline of May 4, 2026. For this vulnerability, the agency prescribes applying mitigations according to vendor instructions, following BOD 22-01 guidance for cloud services, or discontinuing use of the product if mitigations are unavailable.

Both CVEs affect PaperCut MF and NG in versions earlier than 20.1.7. The NVD entry cites PaperCut NG 22.0.5 (Build 63914) as an example of an affected installation. It is important not to confuse these flaws with the new zero-day: they are separate events, but they show that PaperCut products are in the crosshairs of attackers capable of turning an authentication bypass into full system access.

Who Is Behind It: Lace Tempest and Iran-Linked Groups

Activity targeting PaperCut is not new. In May 2023, Microsoft warned that Iran-linked APT groups were exploiting CVE-2023-27350 against PaperCut MF/NG servers. Shortly before that, in April 2023, the same Microsoft had linked attacks exploiting CVE-2023-27350 and CVE-2023-27351 to a financially motivated actor tracked as Lace Tempest, previously known as DEV-0950.

Lace Tempest is described as an affiliate of the Clop ransomware, the same group already linked to GoAnywhere attacks and the Raspberry Robin infection. Since April 13, 2023, Lace Tempest is believed to have added PaperCut exploits to its arsenal. The use of these vulnerabilities in ransomware campaigns explains their presence in the KEV catalog: CISA considers them actively exploited, not merely academic hypotheses.

For the new zero-day, there is no attribution yet. The vendor has not indicated specific actors or campaigns. However, it is prudent to consider that PaperCut products have already been used as a vector for ransomware and espionage: those who expose them to the internet face a concrete, not theoretical, risk.

Indicators of Compromise to Look for in Logs

PaperCut has released some preliminary indicators to help customers determine whether they have been affected. They are not definitive signatures, but signals that warrant investigation.

The first concerns the pc-app.exe executable. Intrusion detection, endpoint security, or network monitoring tools may flag suspicious activity related to this process. Unusual activity from pc-app.exe should be investigated, especially if accompanied by network connections to unexpected destinations.

The second signal concerns log files. Attackers may delete, truncate, or alter PaperCut server.log files to hide their tracks. If a PaperCut server shows missing, inexplicably short, or modified logs, that is a red flag.

Specific strings may appear in server.log, such as:

• ERROR No suitable driver found for jdbc:no:x
• ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

These strings are not normal during regular operation. Their presence, along with other indicators, may indicate an exploitation attempt or already successful access.

What to Do Now: Patch, Isolate, Monitor

The actions to take are clear and should be performed in order.

1. Apply emergency patches. PaperCut has released corrective updates. Anyone who has not yet done so should do so now.
2. Isolate Application Servers. If the server is reachable from the internet, disconnect it or restrict access to trusted IPs only. This measure also applies to those who have not seen suspicious activity.
3. Check logs and indicators. Verify the integrity of server.log, look for anomalous strings, and monitor pc-app.exe.
4. For those using older versions. If you manage PaperCut MF or NG in versions earlier than 20.1.7, you should update anyway: those versions are exposed to the two previous CVEs, already exploited in ransomware attacks. The CISA deadlines for U.S. federal agencies have already passed for both CVEs: May 12, 2023 for CVE-2023-27350 and May 4, 2026 for CVE-2023-27351. But the obligation to update applies to everyone, not just the public sector.
5. Follow BOD 22-01 guidance for cloud services if you use PaperCut in cloud environments. If mitigations are not available, CISA recommends discontinuing use of the product.

The new zero-day does not yet have a CVE, but the vendor’s response and the recommendation to isolate servers point to a concrete threat. Anyone managing an internet-exposed PaperCut should not wait for technical details before acting. Patches are available, and containment measures require nothing more than network restrictions.

PaperCut’s history shows that an authentication bypass can turn into code execution and ransomware. The exposure window must be closed now.