PaperCut is under active attack with no CVE, and the emergency patch skipped its own release process

PaperCut has confirmed that customers are being attacked through an unpatched flaw in its NG and MF print management servers. There is no CVE. There is no entry in CISA’s Known Exploited Vulnerabilities catalog. The emergency builds that shipped overnight do not appear on PaperCut’s own release history, and the vendor says they did not go through its normal release process. If you run PaperCut, the mitigation is the response.

What happened

PaperCut published an urgent security bulletin on 27 August 2026 covering PaperCut NG and PaperCut MF. In the vendor’s own words, quoted identically by four outlets that read the bulletin: “We are aware of confirmed customer incidents and are treating this matter with the highest priority.” The company adds that its investigation is ongoing, and has not disclosed the vulnerability itself, the attack method, or who is behind it.

No CVE identifier has been assigned. This matters more than it sounds: KEV entries are keyed on CVE IDs, so PaperCut’s absence from the catalog is not an oversight by CISA, it is structurally impossible until an identifier exists. Federal remediation deadlines do not attach to this yet, and may not for days.

Be careful with the CVE search results. Two PaperCut CVEs were published on 3 August 2026 — CVE-2026-8793 (excessive authentication attempts, CVSS 6.9) and CVE-2026-8794 (a timing discrepancy enabling username enumeration, CVSS 6.9) — both fixed in 26.0.3 back in July. Neither is this flaw. At least one vulnerability database frames CVE-2026-8794 as “the August 2026 bulletin,” which invites exactly the wrong conclusion.

PaperCut’s stated mitigation is unambiguous: “If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only.” Reporting indicates the guidance extends to taking servers offline entirely where access cannot be restricted, and that administrators should act even without evidence of compromise.

The indicators of compromise, consistent across every outlet that read the bulletin:

• Suspicious activity from the pc-app.exe process
• Missing, truncated, or deleted server.log files
• ERROR No suitable driver found for jdbc:no:x
• ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
• IDS, EDR, or network monitoring alerts referencing the Application Server

PaperCut also warns that the absence of these indicators does not mean a server is clean, because the attackers delete logs behind them. That is an unusually honest thing for a vendor to put in writing, and it should shape how you interpret a quiet hunt.

The patch that isn’t quite a patch

Emergency builds went out at approximately 2:10 a.m. AEST on 28 August, covering the version 25 and version 26 branches across Windows, Linux, and macOS. Version 24 had no fix at the time of writing.

Four build numbers are circulating: PaperCut MF 26.0.4 build 76494, NG 26.0.4 build 76495, MF 25.0.12 build 76496, and NG 25.0.12 build 76497. Huntress lists the 25.0.12 pair; two other outlets list all four, matching exactly.

None of these builds appear on PaperCut’s own release history pages. As of checking, NG and MF 26.0 release history still show 26.0.3 as newest, dated 28 July. The 25.0 histories still show 25.0.11, dated 5 May. PaperCut’s MF version-check page still advises upgrading to 26.0.3.

There is a coherent explanation, and it is itself the newsworthy part. The Register reports PaperCut is distributing an emergency patch that “has not gone through our usual release process.” A second outlet carries the same characterization. These appear to be genuine out-of-band builds shipped outside the normal channel — which is why the version checker does not know about them.

That is a defensible decision by a vendor under fire. It is also a decision whose risk you inherit when you install it: a build that skipped the usual QA, applied to a server that sits in the middle of your network.

What exploitation actually looks like

Huntress reports limited exploitation across two customer environments, the first on 26 August and the second on 27 August. In the first, the exploitation window lasted under two minutes.

The observed activity: base64-encoded reconnaissance commands written into server.log — whoami & ver and whoami & ver & tasklist. Malicious Java class files recovered from an infected Windows host, named Udydn.class and Moo97.class, writing output to Udydn.out and Udydn.cmd. The tooling is OS-agnostic across Linux and Windows, and it self-deletes along with its logs. A further log artifact worth grepping for: DB URL: jdbc:derby:memory:pwn.

Separately, and in a lab rather than in the wild, Huntress reproduced a pre-authentication remote configuration takeover and a full remote code execution chain against build 25.0.11.75758. Their description of the root cause: “A specifically crafted request can refer to one page that is rendered for the response, and another page that owns the component or action being executed,” such that “PaperCut’s authorization check could trust the rendered page and miss the permissions required by the component behind it.”

That is an authorization-bypass-to-RCE characterization from Huntress. PaperCut has published no technical detail of its own. The “pre-auth RCE” framing in today’s headlines traces to Huntress’s lab work, not to the vendor.

Why it matters

Print management is one of those categories that acquires enormous privilege without anyone deciding it should. The Application Server holds credentials, reaches directory services, touches file systems across the estate, and tends to be exempted from the network segmentation applied to things people think of as sensitive.

The 2023 precedent is the reason this is being taken seriously: CVE-2023-27350 in PaperCut MF/NG ended with Cl0p and LockBit deployments against organizations that did not move fast. No connection between that flaw and this one has been established by anyone, and searching for PaperCut attacks surfaces a great deal of 2023 attribution — Cl0p, LockBit, Lace Tempest, Iranian state-backed groups — that belongs to a different vulnerability. Nobody has named an actor in this campaign. PaperCut explicitly has not.

One practical trap: PaperCut’s product pages currently carry an “URGENT security message for all NG/MF customers” banner. It links to a bulletin titled “URGENT MF/NG vulnerability bulletin (March 2023)” — the CVE-2023-27350 advisory. Anyone following the site’s own banner lands on a three-year-old page.

What to do

• Restrict Application Server web access to trusted IP ranges now, or take it off the internet. This is the vendor’s instruction and it does not depend on a build number existing, being verifiable, or having passed QA.
• Hunt the indicators above, and treat a clean result as inconclusive. The vendor says so itself. Deleted or truncated server.log files are the signal, and their absence is not an all-clear.
• If you apply the emergency build, do it knowing it bypassed normal release QA. That is a tradeoff to make deliberately, not a free action.
• On version 24, there was no fix at the time of writing. Mitigation is all you have.
• Do not follow the banner on PaperCut’s product pages. It goes to the 2023 advisory.

Sourcing note

PaperCut’s bulletin body does not render to automated retrieval; every vendor quotation above is taken from outlets that read it directly, and the quoted lines appear near-identically across BleepingComputer, Help Net Security, Security Affairs, and The Register. The build numbers are reported by Huntress and two other outlets and do not appear on PaperCut’s own release history pages — treat them as reported, not vendor-confirmed. The technical root-cause analysis and the exploitation observations are Huntress’s, not PaperCut’s. No CVE has been assigned. Not in CISA KEV, which requires a CVE. No threat actor has been named by anyone, and ransomware attribution found in search results belongs to the 2023 PaperCut flaw, not this one. A report that the vulnerability was discovered by a university customer’s internal security team appears in one outlet only and is not vendor-confirmed.