PaperCut NG/MF Zero-Day: Attackers Compromise Print Servers in Under Two Minutes — Emergency Patches Released August 28, 2026

Your print management software just became the fastest path into your network. On 27–28 August 2026, PaperCut Software issued an urgent, out-of-cycle security advisory confirming that an unknown vulnerability in every current version of PaperCut NG and PaperCut MF is being actively exploited in the wild. Huntress researchers documented live attacks that achieved code execution on a production server in under two minutes — with no credentials required. Emergency patches dropped at 2:10 a.m. AEST on 28 August, but v24 fixes are still in progress. If you or your clients run PaperCut on an internet-facing server and have not yet acted, the clock is running against you right now.

What Is PaperCut and Why Does This Matter?

PaperCut NG and PaperCut MF are enterprise and institutional print management platforms used by thousands of universities, hospitals, government offices, and corporate IT environments worldwide — including a significant deployment base across Indian educational institutions and BFSI organisations. PaperCut’s Application Server acts as the central control plane for every print job, user account, printer policy, and billing record in an organisation. Compromise of this server hands an attacker the ability to harvest credentials from every print-enabled endpoint on the network, execute arbitrary code as a high-privilege service account, and use the server as a pivot point into deeper infrastructure.

This is not the first time PaperCut has been targeted. In April 2023, threat actors — later confirmed to include Russia-linked ransomware operator Lace Tempest and the Cl0p gang — mass-exploited CVE-2023-27350 (CVSS 9.8), a pre-authentication remote code execution flaw, within days of its public disclosure. The pattern is repeating in August 2026 — and this time, exploitation preceded the advisory.

Technical Breakdown: How the Zero-Day Works

While PaperCut has withheld full technical details to prevent further exploitation, analysis by Huntress researchers reveals the core attack chain:

The vulnerability stems from an authorization logic flaw in PaperCut’s web application layer. The server can be tricked via a crafted HTTP request that specifies one page for rendering the response while simultaneously executing a component or action that belongs to a different, privileged page. This request-page mismatch bypasses access controls entirely, granting unauthenticated attackers the ability to:

1. Modify server configuration — including database connection strings, changing the internal database URL to a specially crafted value (observed payload: jdbc:derby:memory:pwn).
2. Execute arbitrary Java bytecode — by abusing unsafe dynamic class loading in the database connection utilities. Attackers uploaded malicious Java .class files (Udydn.class, Moo97.class) directly into the server’s /lib/ directory.
3. Run system commands as the PaperCut service account — initial payloads executed Base64-encoded reconnaissance commands (whoami & ver, whoami & ver & tasklist) and exfiltrated output to Udydn.out, then deleted all log evidence including server.log.

Attack Timeline Observed by Huntress (August 2026)

Phase	Attacker Action	Evidence
Initial Access	Crafted unauthenticated HTTP request to Application Server	pc-app.exe spawning unusual child processes
DB Manipulation	Database URL overwritten to jdbc:derby:memory:pwn	Error log: “No suitable driver found for jdbc:no:x”
Class Upload	Malicious Udydn.class, Moo97.class written to /lib/	Unexpected .class files in PaperCut library directory
Execution	System commands run; output written to Udydn.out	Base64-encoded whoami & ver & tasklist
Anti-Forensics	server.log deleted or truncated to remove evidence	Missing or zero-byte server.log after the incident

The entire chain — from initial request to full recon and log wipe — completed in under two minutes in observed incidents. Internet-exposed PaperCut Application Servers are the primary target; those isolated behind firewalls face significantly lower immediate risk.

Patch Status: What Is Fixed and What Is Not

PaperCut released emergency, out-of-cycle builds at 02:10 AEST on 28 August 2026 covering the v25 and v26 branches of both NG and MF for Windows, Linux, and macOS installers. A second “Release 2” patch followed shortly after with additional hardening. The official PaperCut security advisory is being updated in real time.

Emergency Patch Versions (v25 on Windows)

Product	Patched Version	Status
PaperCut NG v25	25.0.12.76497	Available
PaperCut MF v25	25.0.12.76496	Available
PaperCut NG/MF v26	v26 branch	Available
PaperCut NG/MF v24 and earlier	—	Patch in progress — apply mitigation now

Note: For the most current patch versions for Linux and macOS builds, consult the PaperCut security bulletin directly as it is being updated continuously.

Indicators of Compromise: Check These Now

PaperCut and Huntress have confirmed the following IOCs. The absence of these indicators does not guarantee that a server is clean — attackers are actively deleting evidence — but their presence is a near-certain sign of compromise:

• Unusual child processes spawned by pc-app.exe
• Unexpected .class files in PaperCut’s /lib/ directory — specifically Udydn.class and Moo97.class
• Log entry: ERROR No suitable driver found for jdbc:no:x
• Log entry: ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
• server.log that is missing, zero-byte, or unexpectedly truncated
• Database URL changed to jdbc:derby:memory:pwn in configuration
• Presence of Udydn.out file containing reconnaissance command output

What You Should Do Right Now: Sanjay Seth’s Expert Recommendations

With over 30 years in enterprise security and deep expertise in zero-trust network design, I have seen this pattern before — most recently when the 2023 PaperCut crisis hit unpatched servers within days of disclosure. The window to act before ransomware operators weaponise this flaw is short. Here is your prioritised response plan:

1. Immediately restrict web interface access (do this in the next 60 minutes).
   Block all inbound traffic to PaperCut’s Application Server web interface (default port 9191/9192) from untrusted networks using firewall ACLs. Allow only your internal management subnets. If you use a FortiGate or equivalent NGF, create a specific deny policy for external access to these ports and log all hits. This single step eliminates the internet-facing attack surface while you prepare to patch.
2. Patch v25 and v26 deployments immediately.
   Download the emergency build directly from the PaperCut advisory page. Do not wait for your standard change-management cycle — this is an emergency. Patch management systems (including those managed via zero-trust network segments discussed in our FortiOS advisory) should be updated out-of-band.
3. If on v24 or older: isolate immediately.
   Take the server completely off the network or restrict it to a management-only VLAN until the v24 patch is available. Do not rely on the firewall mitigation alone for extended periods — assess whether print operations can be routed through a patched v25/v26 instance.
4. Run an IOC check on all PaperCut Application Servers right now.
   Check the /lib/ directory for unexpected .class files, review server.log for the error strings listed above, and verify the database URL configuration has not been tampered with. If you find any IOC, treat the host as compromised: isolate, preserve forensic image, and initiate your incident response plan. Do not simply reboot — rootkits and persistence mechanisms may survive.
5. Activate enhanced monitoring on print service accounts.
   PaperCut typically runs as a highly privileged Windows service account. Alert on any new process spawning from pc-app.exe, any lateral movement from the PaperCut host, and any new scheduled tasks or services created after the attack window (25–28 August 2026). Integrate these alerts into your SOC/SIEM.
6. Notify managed clients immediately (MSPs and channel partners).
   If you manage PaperCut deployments for clients — particularly educational institutions and healthcare organisations in India — push this advisory today. The 2023 PaperCut crisis caused significant damage to Indian universities that were slow to patch. Similar exposure exists now for organisations running v24. As with recent pre-auth RCE campaigns targeting managed services infrastructure, MSPs are high-value targets for initial access.

The Ransomware Risk Is Real

This bears direct emphasis: ransomware groups discovered PaperCut in 2023 and they have not forgotten it. The CVE-2023-27350 crisis demonstrated that PaperCut’s position in networks — typically trusted, frequently over-privileged, rarely micro-segmented — makes it an ideal ransomware staging point. Once attackers execute code on the Application Server, they gain access to service account credentials, printer network segments, and in many organisations, direct routes into file servers and Active Directory. The 2026 zero-day offers the same opportunity.

According to BleepingComputer’s reporting on this incident, exploitation was confirmed before the advisory was published — meaning threat actors had a head start. The Hacker News and Help Net Security have both confirmed the scope of the active exploitation. The race to patch before ransomware operators operationalise this flaw is on.

Frequently Asked Questions

Are PaperCut servers behind a firewall still at risk?

Servers that are not reachable from the public internet face a significantly reduced immediate risk — the attack requires network access to the Application Server’s web interface. However, insider threats, VPN-connected contractors, and lateral movement from an already-compromised network node can still reach these servers. Patching remains essential regardless of network position, and internal segmentation should be reviewed.

Will antivirus or EDR detect these attacks?

Standard antivirus is unlikely to flag the initial web-layer exploitation. EDR tools with process-behaviour monitoring may detect the unusual child processes spawned by pc-app.exe, or the creation of unexpected .class files. However, the attack’s speed (under two minutes) and log-wiping behaviour make real-time detection challenging. Proactive IOC hunting and network traffic analysis are more reliable controls in this scenario.

My organisation is still on PaperCut v24. What do I do right now?

Apply the firewall mitigation immediately: block all external access to ports 9191 and 9192. Then assess whether an emergency upgrade to v25 or v26 is feasible — upgrading version branches is often straightforward and the security benefit outweighs the testing overhead in a crisis. Monitor the PaperCut advisory page for the v24 patch, which is in progress. Run IOC checks now on all v24 Application Servers.

How do I know if my server was already compromised before I learned about this?

The critical challenge is that attackers delete server.log — your primary audit trail. Check for unexpected .class files in the PaperCut /lib/ directory, review your network firewall logs for suspicious outbound connections from the PaperCut host (particularly to unknown IPs on non-standard ports), and examine your SIEM for authentication events from the PaperCut service account outside normal hours. If you have any doubt, engage a forensic specialist before assuming the system is clean.

Take Action Before the Ransomware Groups Do

The PaperCut zero-day is a high-urgency threat that requires action in hours, not days. Every internet-facing PaperCut Application Server is a potential entry point into your organisation right now, and every organisation that delays patching is gambling against motivated, technically capable threat actors who know exactly what they are looking for.

If your organisation uses PaperCut NG or MF and you need help with emergency network isolation, zero-trust segmentation to protect the Application Server, patch coordination across multiple sites, or post-incident forensic assessment, contact Sanjay Seth and the P J Networks team for an immediate security consultation. With three decades of experience securing enterprise networks across India — including FortiGate-based zero-trust deployments — we can help you close this exposure fast.