PaperCut Rushes Out Second Fix as Attackers Chain Bugs to Run Code
A newly patched flaw in the widely used print management software is being actively exploited, and PaperCut has shipped emergency hardening on top of the original patch.
Key points
- PaperCut has released an emergency update for its NG and MF print management software after attackers were seen chaining two flaws to run code on servers.
- The main bug lets an attacker with no login change PaperCut's trusted settings and run Java code inside the application.
- Print management servers often sit deep inside company networks, which makes them a useful jumping-off point for wider attacks.
- Administrators are being told to patch immediately and check whether their PaperCut server is reachable from the public internet.
PaperCut, the Australian company behind the print management software of the same name, has pushed out a second emergency patch after attackers started chaining two vulnerabilities to run code on unpatched servers without needing a password.
Print management software is the boring plumbing that decides who can print what, tracks page counts, and bills departments. It runs on a server inside the company network. When that server gets popped, the attacker is usually already inside the building, digitally speaking.
That is the problem here.
What is the actual bug?
The headline flaw lets an unauthenticated attacker, meaning someone who has not logged in, reach into PaperCut's trusted configuration and change it. Once inside that configuration, they can execute arbitrary Java code, which in plain terms means running whatever program they want on the server, with the application's own permissions.
According to reporting by The Hacker News, attackers are pairing this with a second weakness to make the attack reliable end to end. PaperCut's fresh update adds hardening on top of the original patch, which usually means the first fix did not fully close the door.
In practice, once you can run Java code inside a service like this, you own the server. From there it is a short walk to Active Directory, file shares, or whatever else the server can talk to.
Who uses PaperCut?
PaperCut is not a niche tool. It is used by universities, hospitals, local governments, law firms and large enterprises around the world to manage office printing. The vendor claims hundreds of millions of users across more than 100 countries.
That installed base is why this class of bug keeps coming back. In 2023, ransomware crews including Cl0p and LockBit were seen breaking into PaperCut servers to get an initial foothold, and the same playbook applies again now.
What should IT teams do right now?
Patch, and check exposure. The failure mode here is a PaperCut server that is reachable from the public internet because someone wanted remote print release to "just work" from home. That is the machine attackers are scanning for.
| Item | Detail |
|---|---|
| Affected products | PaperCut NG and PaperCut MF |
| Type of flaw | Unauthenticated remote code execution via trusted config |
| Fix | Latest emergency update from PaperCut |
| Exploitation status | Active, in the wild |
One thing the post-mortem will say, again, is that the print server was directly exposed. If yours is, put it behind a VPN or an access proxy, restrict the admin interface to internal IPs, and pull the logs to look for unexpected config changes or new scheduled scripts.
Also worth checking: outbound connections from the PaperCut host. A print server calling out to a random IP on port 443 at 2am is not doing print jobs.
Operational takeaway: treat your print server like a domain controller, because to an attacker chaining these bugs, it basically is one.
