URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)

THE PAGE APPLIES TO:

Last updated August 29, 2026

URGENT Security Advisory

PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.

We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing. We will update this security bulletin as verified information becomes available, including indicators of compromise and remediation guidance.

Immediate action required

If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses).

Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.

Emergency Patch Release 2

This is an emergency patch for customers with public-facing PaperCut NG/MF servers who are unable to take other mitigating action.

[Update: 28 August 2026 8:42pm (AEST)]

Following further work with our internal security team and external researchers, including Huntress and watchTowr, we have released an updated Emergency Patch (Release 2) that includes additional hardening beyond the original emergency patch. We recommend all customers install Release 2, even if you have already applied the original emergency patch.

Download and follow the standard upgrade procedure.

PaperCut MF

MF Version	Download links	Checksums (SHA256)
v26	Windows (exe)	5c63ef18c523c85d5e73efc7fbb2bd2edacf0b03bcf80fe4d7e4c1a7c8bcbcf4
	Linux (sh)	6117b53dd0610052c53aeafced91cd3d0ad80ed1dcc578e873291a8b697b802a
	macOS (dmg)	7dea84473f8d00d4608b7e797b633f130139e23bf5bba02848a1df0a7e2cc7c6
v25	Windows (exe)	b296de7da020152a83291378ab4ca5c461d76510648347fd6e69f3fb2cd5e9c9
	Linux (sh)	296498ef5ec1ac8927dc1ccae9a9aa3c04036da6d2768813e6df818049b3f4a1
	macOS (dmg)	3e5509f0514228031967934d32e4a40512bd6fb5857bfde3002866bc3ede3f9a
v24	Windows (exe)	75aba456d6629848c89513371c44037f2bdddbc1e39bdadc16d1fed8b59766eb
	Linux (sh)	7ac8f002fb602d1f54665d8a18a25fc57cf41239ae0c03b18591ee220b57d419
	macOS (dmg)	40581392cc11a1f46b90ab5c2607fdacade77aca0de6629c1d78a2a71548fc9c

PaperCut NG

NG Version	Download links	Checksums (SHA256)
v26	Windows (exe)	c9a2b356910b5fef3c114d48cb7c508414d1d35ddac74c530d1e8923d357e7d4
	Linux (sh)	3261356ced056fd5ab0962a07178701e80c6ebbce30d7158d20ed3c57b1dcf59
	macOS (dmg)	bdd54d5cb9f20924b059986a44f849df499f7de7cb5cd0a60290d2b2610850e7
v25	Windows (exe)	b155cf19cdab1b7fc92c2dd030d1c0cd439397d83d7749042f65e2364ca03589
	Linux (sh)	282be7404a25c12317a2079eed59e8794f0c9d7bd257dee60c39b529da18a46a
	macOS (dmg)	276ee64a7bb4d4e242fe7ddaecf3cd279eee91e83fbd1e6f44050db2f90bda6d
v24	Windows (exe)	f58a3fe4e9d7543c38a3f01e53f4a9ad34884289a71df25f734af9d977c06319
	Linux (sh)	a7ea1e2cdb22a4349ae854491b10b89a52d075e9106ec68f838f12d5f2a15f51
	macOS (dmg)	1e70dd6510d0b9618035a3db462b78ece06cd70f41bcccca8196c015c46a480b

Post Install Check:

Are you using an external database for Card/ID number lookups? Review the FAQ below.
Using site-servers? Review the FAQ below.

Security issues addressed

Our security team has now made public the following two CVE’s.

CVE

Notes

CVSS rating and vector

CVE-2026-82078

Unsafe Dynamic Class Loading in Database Connector

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers.

Vulnerability Type: CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection').

Impact: If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Mitigated in: PaperCut NG/MF Emergency Patch Release 2 (see above).

9.4 (CRITICAL)

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVE-2026-81578

Authentication Bypass

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks.

Vulnerability Type: CWE-306 Missing authentication for critical function.

Impact: This allows an unauthenticated remote attacker to modify certain system configurations.

Mitigated in: PaperCut NG/MF Emergency Patch Release 2 (see above).

8.8 (HIGH)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Who is potentially impacted

This advisory applies to all versions of:

PaperCut NG
PaperCut MF

Indicators of compromise and investigation guidance

The following may be indicators of compromise:

Alerts from intrusion-detection, endpoint-security, or network-monitoring tools involving the PaperCut Application Server, particularly suspicious post-exploitation activity from pc-app.exe.
Missing, unexpectedly truncated, or deleted PaperCut server.log files.
Any of the following entries in server.log:
ERROR No suitable driver found for jdbc:no:x

ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

Important: The absence of the above indicators is not confirmation that a system has not been affected. PaperCut will publish validated, specific indicators and further guidance here as soon as they are available.

Current Status

Update	Details
Investigation progress	PaperCut’s security emergency response team has used information provided by a university customer’s security team and digital forensics and incident response team. This information has enabled PaperCut to reproduce a vulnerability in the PaperCut NG and PaperCut MF code. Our emergency engineering team is developing and validating an appropriate code fix.
Emergency patch released	An emergency patch is available for v25 and v26. See download links above and follow the upgrade process.
Emergency Patch Release 2 published	An updated Emergency Patch (Release 2) is now available for v24, v25, and v26, including additional hardening. We recommend all customers install Release 2 in place of the original emergency patch. See download links above and follow the upgrade process. Our emergency security response team will be continuing to work over the weekend.

FAQs

Q Is this an official release?

No. We have not gone through our usual release process. This is an emergency patch for customers with public-facing PaperCut servers who are unable to take other mitigating action. More information will be published as it becomes available.

Q Do I need to update other components (e.g. Site Servers and Secondary servers)?

Site Servers and secondary/print servers should be updated to a patched version, not just the primary Application Server.

Other components such as Print Deploy and Mobility Print are not affected and do not need to be updated.

Q What should I do if I suspect my server has been compromised?

If you suspect your server has been compromised, we recommend securing current server backups, completely wiping and rebuilding the Application Server, and restoring a clean backup taken before any suspicious behavior was detected. Additionally, you should activate your organization's security response procedures and follow standard incident protocols.

Our insight into individual environments is limited, so we cannot confirm or assess the full scope of impact from a compromised server.

Q Will there be a release for NG/MF 23 and earlier?

The recommended path for all customers prior to PaperCut NG/MF v24 is to upgrade to the latest version.

Q My install uses an external database for card number lookups, what changes are required?

This is a rarely used feature and most customers will not need to take any action, for those that do, follow these steps:

Add security.card-number-lookup.enabled=Y to server/security.properties and restart the Application Server.

The default setting for this feature is off (N) which disables the feature. Without this key set, PaperCut NG/MF will silently ignore any external user lookup calls even though the Admin UI may still show the feature as configured.

Q How do I apply the Emergency Patch?

Download and follow the standard upgrade procedure.

Security notifications

To stay informed about high impact security updates please subscribe to our Security notifications sign-up form.

Updates

Date	Update/action
27 August 2026 (AEST)	Published the initial Security Bulletin.
27 August 2026, 8:00pm (AEST)	Minor wording updates.
27 August 2026, 9:02pm (AEST)	Investigation update posted.
28 August 2026, 02:10am (AEST)	Published emergency patch. Patch released for PaperCut NG/MF v25 and v26.
28 August 2026, 10:43am (AEST)	Additional information added for customers using Card/ID number lookups from an external database.
28 August 2026, 08:42pm (AEST)	Published Emergency Patch Release 2 which includes additional hardening developed with internal security and external researchers. Added guidance on required `security.properties` change for Card/ID number lookup customers. PaperCut would like to thank Huntress and watchTowr for their ongoing security analysis, helping to harden Release 2.
28 August 2026, 10:08pm (AEST)	Published Emergency Patch Release 2 for PaperCut NG/MF v24.
28 August 2026, 10:53am (AEST)	Additional FAQ added.

Category: Security Bulletins

Subcategory: Security and Privacy

Comments

Comments are not available in this preview environment. On papercut.com, this space shows the live Disqus comment thread for this page.