If your office uses PaperCut to manage printing — and a lot of small businesses, schools, law firms, and medical practices do — you have an urgent patching problem this week. Attackers are actively chaining two zero-day flaws in PaperCut NG and PaperCut MF to break into print servers without a password, and as of August 31 they're also using the same holes to steal data straight out of the database. CISA added both bugs to its Known Exploited Vulnerabilities catalog on Sunday, which means federal agencies (and you) are on a short clock to fix this.
What happened
On August 27, PaperCut Software issued an urgent security bulletin for two zero-day vulnerabilities in PaperCut NG and PaperCut MF — its widely used print management software. The vulnerabilities are CVE-2026-82078 (CVSS 9.4) and CVE-2026-81578 (CVSS 8.8), which can be leveraged by an unauthenticated attacker to modify system configurations and potentially lead to Remote Code Execution.
The two flaws chain together. CVE-2026-81578 is an improper access control vulnerability in the PaperCut NG/MF web management interface that enables an unauthenticated remote attacker to edit configurations, and the second bug then lets the attacker load malicious Java code onto the server. Attackers combined them to achieve pre-authentication remote code execution against PaperCut's Application Server, no credentials required, no user interaction needed. That is about as bad as a vulnerability chain gets: it turns an internet-reachable print management server into a foothold with zero friction.
The vulnerabilities affect all versions of PaperCut NG and PaperCut MF software prior to Aug. 27, 2026, with emergency patches available for NG/MF versions 24, 25 and 26 on Windows, Linux and macOS. PaperCut had to ship a second emergency patch a day later after researchers found the first fix could be bypassed.
Why this is worse than a normal print-server bug
Two things pushed this from 'urgent' to 'stop what you're doing':
First, exploitation started before anyone had a patch. Huntress reported that it detected exploitation of CVE-2026-82078 and CVE-2026-81578 in two customer environments as of Aug. 27.
Second, the attackers are no longer just proving they can get in — they're stealing data. "We are observing CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF) exploit activity in our honeypots since late yesterday UTC (Aug 29th)," Defused said. "An actor is abusing the auth bypass to hijack PaperCut's external user-lookup. Unlike the RCE path in public writeups, the actor goes for data theft - dumping DB tables via Derby."
And the exploitation bar just dropped through the floor: On August 31, 2026, both CVE-2026-81578 and CVE-2026-82078 were added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) list of known exploited vulnerabilities (KEV), based on evidence of active exploitation. A Metasploit module is now available to validate exposure to the exploit chain — which also means every low-skill attacker on the internet now has a point-and-click way to try it.
What your managed-IT provider should be doing this week
If you outsource IT — whether to a full MSP or through a co-managed arrangement with an in-house tech — here's the short list you should be hearing back on by end of week:
1. **Inventory.** Do you run PaperCut NG or PaperCut MF anywhere? Print servers often get installed once and forgotten. Your provider should be able to answer this in minutes, not days.
2. **Patch to the current release.** Both emergency fixes need to be applied. The first patch alone is not enough — WatchTowr found bypasses that forced the second patch.
3. **Take the admin interface off the public internet.** There is no good reason for a PaperCut Application Server's web management interface to be reachable from outside your network. If it is, that ends this week.
4. **Hunt for signs it already happened.** Because exploitation predates the patch, patching is not the same as being safe. Your provider should be reviewing PaperCut logs for base64-encoded reconnaissance commands, checking for unexpected admin-config changes, and looking for Derby database dumps.
5. **Rotate credentials tied to the server.** Service accounts, LDAP binds, anything the PaperCut server touched. Assume they've walked out the door.
If you're not sure whether any of the above is happening, that itself is the answer — and it's the reason 24/7 monitoring and after-hours patching muscle exists.
What York Businesses Should Do
PaperCut is common in York County offices, school districts, and professional practices that meter printing — it tends to sit quietly on a server nobody thinks about until something breaks. York Computer is checking client environments for exposed PaperCut servers this week; if you're not sure whether you run it, that's the first question to ask your IT contact today.
Sources
- More Details Emerge on Exploited PaperCut Vulnerabilities (SecurityWeek)
- PaperCut NG/MF Critical Zero-Day Exploited in the Wild (Rapid7)
- Recently patched PaperCut zero-days used in data theft attacks (BleepingComputer)
- PaperCut issues emergency patches for actively exploited critical vulnerability (SC Media)
- PaperCut Discloses Zero-Day Vulnerabilities (eSentire)