PaperCut Issues Emergency Patches Amid Active Exploitation Risks

PaperCut, a company known for its printer management software, has issued a warning regarding two significant security vulnerabilities that are currently being exploited by cybercriminals. The flaws are present in its PaperCut NG and PaperCut MF software, both widely used across numerous sectors including education and business.

The software vulnerabilities, designated as CVE-2026-82078 and CVE-2026-81578, have received severity ratings exceeding 8.8 out of 10, indicating a high level of risk. PaperCut's security response team is actively investigating the situation, acknowledging confirmed incidents that demonstrate customer exposure to these exploits.

In a recent advisory, PaperCut advised its clients to enhance their security measures by removing their servers from public access and limiting web access to trusted IP addresses only. The company stated, "Take this action now, even if you have not observed suspicious activity."

The vulnerabilities allow attackers to execute arbitrary code remotely on unsecured instances, presenting a significant danger to organisations. Research from Huntress, a cybersecurity firm, outlines that these flaws can permit unauthenticated attackers to gain control over PaperCut's configurations, potentially allowing them to execute Java code within the application.

Initial patches provided by PaperCut did not sufficiently mitigate the vulnerabilities, prompting the release of a second emergency update that includes additional safeguards. Collaboration with cybersecurity experts such as Huntress and watchTowr has been instrumental in developing this new patch.

Jake Knott, head of threat intelligence at watchTowr, observed that past vulnerabilities in PaperCut have been exploited by ransomware groups to gain initial access to systems. He remarked, "PaperCut is a prime target for attackers... as it not only provides entry into corporate environments but also contains sensitive information."

Recent analysis by cybersecurity professionals indicates that multiple cybercriminal groups are targeting these vulnerabilities, including known ransomware entities. In March 2023, advisories were issued specifically warning education institutions about the risks associated with PaperCut flaws.

Organisations utilising PaperCut software are urged to act swiftly to protect their systems by implementing the latest patches and ensuring robust security measures to prevent unauthorised access. The high-profile nature of the vulnerabilities means they will likely continue to attract malicious interest, necessitating ongoing vigilance from users.

Given the breadth of PaperCut’s user base, including universities, corporations, and government bodies, the implications of these vulnerabilities are far-reaching. Users are encouraged to regularly monitor their systems for signs of compromise and remain informed about the latest security updates from PaperCut and related cybersecurity advisories.