PaperCut Rolls Out Full Fix for Two Print-Server Flaws Already Under Attack

Key points

• PaperCut released maintenance updates 26.0.5, 25.0.13 and 24.1.10 on Thursday, replacing earlier emergency hotfixes.
• The updates fix two vulnerabilities in PaperCut NG/MF that attackers are already exploiting in the wild.
• Print-management servers often sit on internal networks with wide access, making them a useful stepping stone for intruders.
• Customers who applied the earlier emergency patches still need to install the new maintenance release.
• PaperCut software runs in schools, hospitals and government offices around the world.

PaperCut has published a proper fix for two security flaws in its print-management software that criminals are already exploiting. The releases, first reported by The Hacker News on Thursday, fold the changes into the normal update track rather than sitting alongside it as separate hotfixes.

PaperCut NG and PaperCut MF are the products thousands of organisations use to manage office printing: tracking who prints what and holding jobs until a user taps a card at the machine. If that sounds boring, the servers behind it aren't. A print server usually sits deep inside a company network and talks to almost every workstation, which makes it a comfortable place to pivot from once you're inside.

What are the two flaws?

Both are actively exploited, meaning real intrusions are happening now. PaperCut hasn't published deep technical detail, which is normal while customers are still patching.

The company first shipped emergency patches, small targeted fixes released outside the usual schedule. Thursday's maintenance releases replace them entirely. We've been following this deteriorating situation since 27 August, and last week's report on a Russian-speaking attacker who used AI agents to hit 395 organisations across 48 countries shows how quickly these flaws have been weaponised.

Who needs to act, and how fast?

Any organisation running PaperCut NG or PaperCut MF on-premises should install the new release now, even if they already applied the earlier emergency patch. Cloud-hosted customers are updated by the vendor.

Here is how the versions line up:

Administrators should also check whether their PaperCut admin console is reachable from the public internet. It usually shouldn't be. Restricting the admin interface to an internal network or a VPN cuts off the easiest path an attacker would take.

Does this affect ordinary people?

Not directly. There's no consumer app to update and no password to change. The people who need to act are the IT teams running print services inside schools, hospitals and companies.

PaperCut's history here is worth knowing. In 2023, a different set of flaws in the same product was used by ransomware crews, criminals who lock a company's files and demand payment, to get inside education and healthcare networks. Unassuming servers get exploited precisely because they're assumed to be low-risk.

One point on the authentication side: multi-factor authentication (the extra code or tap on your phone after a password) wouldn't have stopped exploitation of a server-side flaw like this. It's a patching problem. The fix is to install the update.

Common questions

I use PaperCut at work. Do I need to do anything?

No. Your IT team handles the server update. You don't need to change your printing PIN or card.

Is my print history exposed?

PaperCut hasn't said the flaws leak print job contents. The immediate risk is attackers using the server as a foothold to reach other systems on the network.