PaperCut NG/MF administrators should restrict public web access and follow the current vendor patch guidance. The 2023 remote-code-execution and data-exposure flaws described below are separate from the actively exploited 2026 incident.
September 7, 2026: check the current emergency patch
PaperCut’s August 2026 security bulletin covers all NG/MF versions and confirms customer incidents. It identifies CVE-2026-82078 (unsafe class loading) and CVE-2026-81578 (authentication bypass).
- Restrict internet-facing Application Server web access to trusted IPs immediately.
- Install Emergency Patch Release 3 even after Release 1 or 2; it is cumulative. Follow the bulletin’s current downloads and upgrade procedure, including Site and secondary/print servers. Versions before v24 need an upgrade to the latest version.
- External-database card/ID lookup users must follow the bulletin’s configuration instructions; verify that lookup still works after updating.
- Preserve logs and endpoint evidence. Investigate missing or truncated
server.log, unusual JDBC errors, unexpected.class,.cmdor.outfiles under the server directories, shells launched bypc-app.exe, and unapproved SimpleHelp or AnyDesk. - Missing indicators do not prove safety. For suspected compromise, activate incident response, preserve backups and rebuild from a known-clean backup.
Patching prevents further exploitation; it does not undo an earlier intrusion. Keep evidence before cleanup and review access to connected systems with your response team.
What is PaperCut?
PaperCut is a print management solution, which allows fine-tuning printer usage. It provides features such as print job tracking, print quota management, cost allocation, and secure printing, among others. The latter is exceptionally needed to prevent possible data leaks within the company. The software supports a wide range of different printers, scanners, and other devices of that purpose. It is a pretty popular solution – PaperCut describes its reach as 100+ million users around the world. It can be very, very unfortunate if something that popular is unsafe.
The two PaperCut vulnerabilities disclosed in 2023
The 2023 disclosure described two PaperCut vulnerabilities – one is bad, and the other is horrifying. Let’s start with the most worrying one. CVE-2023-27350 allows remote code execution (RCE) without any authentication. RCE/ACE vulnerabilities are extremely dangerous, and seeing a 9+ CVSS rate for them is a common thing. This one received 9.8 points – equalling the MSMQ vulnerability disclosed in April 2023.
How the 2023 attack reached LockBit: PowerShell, netsh and a temporary download
A print server launching a shell is where this story gets interesting. In its April 2023 investigation, Trend Micro described an incident it believed involved exploitation of CVE-2023-27350. The PaperCut process pc-app.exe launched PowerShell, which downloaded and ran a payload and used netsh.exe to circumvent the firewall. Trend Micro identified the payload, enc.exe, as LockBit ransomware. The download came from a temporary hosting service that deleted uploaded files after 60 minutes.
The useful clue is the chain, not an executable name in isolation. PowerShell, netsh and conhost are Windows utilities; do not delete them because they appear in the diagram. Correlate the parent process, command lines and timestamps with downloads and firewall changes. A vanished download is not a vanished incident: the hosting site’s timer does not erase endpoint or network records already collected. Preserve those records before cleanup.
CVE-2023-27351 is less severe, yet still unpleasant. It also allows unauthorised access, but this time users’ information is under attack. Hackers can extract things like full names of the users, usernames, emails and even card numbers. All this information is available from user profiles created in PaperCut MF servers. The exposure includes password hashes for internal PaperCut-created users, not password hashes from synchronized directory accounts.
List of PaperCut software vulnerable to mentioned exploits:
- CVE-2023-27350: NG/MF Application and Site Servers; versions 8.0.0–19.2.7, 20.0.0–20.1.6, 21.0.0–21.2.10, and 22.0.0–22.0.8.
- CVE-2023-27351: NG/MF Application Servers; versions 15.0.0–19.2.7, then the same vulnerable 20.x, 21.x and 22.x ranges above.
- Historical fixes for both: 20.1.7, 21.2.11 and 22.0.9 in their respective branches. These are 2023 patch boundaries, not versions to install as a current security recommendation.
How to protect against PaperCut exploitation
The original PaperCut bulletin documents the 2023 fixes. Use the current bulletin above for today’s upgrade decision. Restrict exposure while arranging the update; antivirus is not a substitute for closing a vulnerable server entry point.
EDR/XDR monitoring and network detection and response can help identify suspicious activity, but neither guarantees prevention or makes a server invulnerable. Review alerts together with server logs and account activity.
If a Windows endpoint also shows suspicious downloads or recurring malware alerts, a Gridinsoft Anti-Malware scan can support endpoint cleanup. Server remediation and an audit of persistence and account changes still need their own checks.
