Enhancements

• Watermarking and digital signatures: Added support for the HMAC SHA-256 algorithm to help organizations meet regulatory security compliance. When configuring print job annotations, System Administrators can now use the new %sig_sha256% and %digest_sha256% variables for more secure cryptographic signatures. [PO-4289]
• macOS User Client and Release Station: Added native Apple Silicon (ARM64) support for the PaperCut User Client, Release Station, and local installer. These applications now run natively on Apple Silicon Mac computers without requiring Rosetta 2 emulation. [PO-4368]
• Notification Emails: Updated the pending refund notification email to show key transaction details, usernames, and requested refund amount of each request. This provides administrators with immediate context on pending requests without needing to log into the PaperCut admin console. [PO-4235]

Fixes

• Fixed an issue on the Web Print User web interface that sometimes caused the submit button to remain active after being clicked. Users can no longer accidentally submit duplicate print jobs by repeatedly clicking the button. [PO-4470]
• Fixed an issue on macOS where upgrading the PaperCut Application Server from version 24.1.5 or earlier could cause the installer to time out and fail. [PO-4330]
• Fixed an issue affecting macOS environments where users were prematurely logged out of the PaperCut User Client. Previously, under certain network conditions involving IPv6 addresses, a single user’s session expiration could inadvertently disconnect other active client sessions. See known issue PO-4041 for more details.
• Fixed an issue where daily database maintenance tasks could consume high memory and impact Application Server stability on systems with large databases. [PO-4432]
• Fixed an issue on the Users list page where screen readers could not fully read data table cells. Improved keyboard navigation and added standard accessibility properties to ensure screen readers uniquely identify and announce cell content correctly. [PO-4218]
• Print Deploy (v1.10.4437): Introduced an enhanced auto-update mechanism using digitally signed payloads in line with security best practices. Note: Actioning this security enhancement requires an over-the-top client reinstall. For full release details, KB guides, and client update instructions, please see the Print Deploy Release Notes.

Security

• Fixed a timing issue on the Admin interface login page to protect against potential user enumeration via slight differences in authentication response times. (CVE-2026-8794). [PO-4320]
• Fixed an MFD login issue for failed login attempts to prevent rapid, automated brute-force login attempts. (CVE-2026-8793). [PO-4319]
• Improved payment gateways security by hardening the “Add Credit” and administration interfaces across all payment gateway integrations against potential Cross-Site Scripting (XSS) vulnerabilities. [PO-3920]
• Updated 3rd party dependancy underscore.js. [PO-4141]

Other notes

• This version does not contain a database upgrade.

New Features

SAML 2.0 Authentication

• This feature introduces SAML 2.0 for single-sign-on support (SSO), enabling PaperCut NG/MF to integrate with external Identity Providers (IdPs) such as Microsoft Entra ID, Okta, and Ping Federate. This allows System Administrators to provide a consistent login flow and leverage IdP security features, including Multi-Factor Authentication (MFA), across all PaperCut touchpoints to significantly enhance environment security. [PO-4158], [PO-638]

Unified Authentication

• We have redesigned the authentication architecture to provide a persistent “sign-in once” experience across the login web interfaces, Print Deploy, and the User Client. This reduces login fatigue for users and simplifies identity management for System Administrators by maintaining a single authenticated session across the platform.

Fixes

• Fixed an issue where logging out of the Mobile Print Release or Web Client interface could trigger an unintended background login request. [PO-1411]
• New payment gateway version available for Touchnet customers. For more information, see Payment Gateway Module Release history. [PO-4327], [PO-4404]
• Fixed an issue where upgrading to version 26 could cause the Application Server service to fail at startup if legacy custom memory configurations (such as MaxRAMFraction) were used in service.conf. Most environments are automatically migrated to modern arguments, but some edge cases may require manual intervention, this was due to a Java update. See known issue PO-4393 for more information.
• Fixed an issue on the Users page where sorting the user list by balance could cause the page to crash when the ‘multiple personal accounts’ feature is enabled. [PO-4415]
• Fixed an issue on the Printers page where disabling a printer could cause an error screen to display, locking the administrator out of the printer’s settings. [PO-4372]
• Fixed an issue in version 26.0.2 (builds 76096 and 76097) where users encountered an error on the User Portal summary page, relating to Payment Gateways. See known issue PO-4444 for more information.

Security

• PaperCut NG/MF Version 26 includes upgrades of core dependencies and several third-party libraries. [PO-3782], [PO-4156], [PO-3511], [PO-4227], [PO-3567], [PO-4224], [PO-4063], [PO-4109], [PO-4277]
• Significant improvements to internal user authentication speed. The hash encode strength was set too high. The default is now 12. Admins can change the strength in the security.properties file by editing user.internal.hash-encode.strength to a value between 4 and 31. [CDSS-6543]

Other notes

• This version contains a database upgrade.