On August 27, PaperCut issued an urgent security bulletin for two vulnerabilities in its NG and MF print management software. Four days later, CISA added one of them to its Known Exploited Vulnerabilities catalog. Huntress and other researchers have since documented attackers using the flaws to run their own code on PaperCut servers with no login required.

If your office runs PaperCut behind its copiers, this is worth your attention today, not next week.

What’s actually broken

PaperCut is the software many offices use to track print jobs, enforce quotas, and route documents to the right copier. It usually runs as a background server that IT sets up once and never thinks about again. That’s exactly the problem.

Two flaws are involved. CVE-2026-81578 lets an attacker reach the web management interface without logging in and change system settings. CVE-2026-82078 lets an attacker set a malicious database driver name, which the server then loads and runs as code. Chained together, an attacker with no credentials and no prior access can take full control of the server.

PaperCut released an emergency patch within 48 hours of the initial reports. Researchers found a way around it within days, and proof-of-concept exploit code is now public, including a working Metasploit module. PaperCut shipped a third, more thorough fix on September 1. If your server was patched after the first advisory but before September 1, you need to patch it again.

Versions affected: anything before 24.1.10, 25.0.13, or 26.0.5. Version 23 and earlier has no patch available at all. If your firm is running a print server that old, an upgrade isn’t optional anymore.

Why a print server is a real attack path

A print server doesn’t sound like a high-value target, which is exactly why it doesn’t get the same attention as email or file servers. But it typically runs with elevated permissions so it can talk to every printer and copier on the network, it often has a service account with broader access than anyone remembers granting, and it frequently sits on the same network segment as everything else because nobody thought to isolate it.

Once an attacker has code execution on that server, they have a foothold inside the network. From there, the same playbook applies as any other initial-access breach: enumerate the domain, look for stored credentials, move toward whatever holds client data. A vulnerability in a remote monitoring tool did something similar in July, when attackers used it to push malware through the exact system meant to protect the machines it managed. Print servers, monitoring agents, backup appliances: these are the pieces of infrastructure that run quietly in the background for years, and attackers know that’s often where the least scrutiny lives.

This particular chain is also a good example of how patching alone doesn’t always close the door. PaperCut’s first patch went out fast, within two days of the initial reports. Researchers found a bypass within days of that. The company’s third release, on September 1, is described as the more durable fix, but the pattern shows why “we patched it” isn’t always the same as “it’s fixed.” Firms relying on a single patch cycle without confirming exploitability afterward can end up with a false sense of security for a week or more.

What we found checking our own clients

When this hit our radar, we went through our managed clients to see who runs PaperCut. Only one does. Their server has never been exposed to the internet, so it isn’t reachable by the remote attackers researchers are tracking. That’s not luck so much as the result of a basic rule: print servers, like domain controllers and backup systems, should never be directly accessible from outside the network. If yours is managed by an outside provider, ask them to confirm that in writing, not just assume it.

Plenty of firms elsewhere are not in that position. Shodan and ShadowServer scans this week found more than 1,000 PaperCut instances still reachable from the open internet on their default management ports, an application with no legitimate reason to be internet-facing in the first place.

What to check this week

If your office uses PaperCut, or you’re not sure whether it does, start by asking whoever manages your network (internal IT or your MSP) three questions: what version of PaperCut NG or MF is running, whether the server is reachable from the internet, and whether the September 1 patch has been applied even if an earlier one already was.

If nobody can answer those three questions quickly, that’s the real finding. It usually means the print server was set up years ago, has worked fine ever since, and hasn’t been part of anyone’s patching or monitoring routine since the day it was installed. A quick way to think about scope: any server that “just works” and hasn’t come up in a conversation with your IT provider in the last year is worth a second look, whether it happens to run PaperCut or something else entirely. This one just happens to be this month’s reminder of why that check matters, and law firms handling client documents through a shared print environment have more reason than most offices to take it seriously.

If you’re not sure what’s running on your network or whether it’s been patched, we can help you find out.