PaperCut Warns of Active Attacks — But the Vulnerability Details Are Still Being Withheld

• The Mess: PaperCut has confirmed that attackers are actively exploiting a vulnerability in PaperCut NG/MF. The company knows of confirmed customer incidents, yet the technical details of the flaw have not been publicly disclosed while the investigation and remediation work continue.

PaperCut’s own security bulletin makes this one even stronger: the company says it has confirmed customer incidents, its emergency response team has reproduced the vulnerability using information from a university customer’s security and DFIR teams, and engineers are still developing and validating the fix. The company has not yet published the technical details, indicators of compromise, or remediation guidance.

The Vulnerability Has No Public Technical Name Yet

That’s what makes this incident unusual.

Right now, administrators don’t have the usual checklist:

CVE → CVSS score → affected versions → patch → done.

Instead, they have:

confirmed attacks → vulnerability reproduced → fix still being developed.

PaperCut says it will release verified information, including indicators of compromise and remediation guidance, as it becomes available.

That means this is not just another vulnerability announcement.

The attackers appear to have moved first.

A University Helped Reveal the Problem

According to PaperCut, information provided by a university customer’s security team and digital forensics and incident-response team helped the company’s emergency response team reproduce the vulnerability in PaperCut NG and PaperCut MF.

That detail matters.

It suggests the issue wasn’t discovered in a routine code audit and quietly fixed before anyone noticed.

The investigation was driven, at least in part, by a real customer incident.

PaperCut is treating the matter as a security emergency and says the investigation remains ongoing.

PaperCut Servers Can Be Much More Valuable Than Printers

It’s easy to hear “print management software” and underestimate the target.

That would be a mistake.

PaperCut NG/MF can sit inside environments containing:

• Active Directory integration;
• user identities;
• authentication workflows;
• print-server infrastructure;
• administrative accounts;
• server-side services;
• connections to other enterprise systems.

A compromised PaperCut server could therefore become more than a printing problem.

It could become an internal foothold.

And history has already shown that attackers are interested in PaperCut infrastructure. Previous PaperCut vulnerabilities were actively exploited after disclosure, including flaws that allowed authentication bypass or remote code execution.

The Fix Isn’t Available Yet

This is the uncomfortable part.

PaperCut’s current bulletin says its emergency engineering team is still developing and validating an appropriate code fix.

So, at the moment, organizations can’t simply be told:

Update to version X.

The immediate priority should be reducing exposure and preparing for the vendor’s remediation guidance.

Administrators should closely monitor PaperCut’s official bulletin:

What Should Administrators Do Right Now?

Until PaperCut releases official remediation instructions, organizations should focus on exposure reduction and detection.

Check:

• whether PaperCut NG/MF administration interfaces are reachable from untrusted networks;
• recent administrator and user activity;
• unexpected account changes;
• unusual processes on PaperCut servers;
• suspicious outbound connections;
• newly created services or scheduled tasks;
• unexpected configuration changes;
• authentication anomalies around the time suspicious activity began.

And, importantly:

preserve logs.

If you discover suspicious activity after the vendor releases indicators of compromise, old logs may become the only way to determine whether your environment was affected.

Don’t wipe everything before preserving evidence.

Don’t Confuse This With an Old PaperCut CVE

PaperCut has faced actively exploited vulnerabilities before, including the high-profile 2023 issues.

This is different.

The company’s current August 27 bulletin describes an ongoing investigation into a newly reproduced vulnerability connected to confirmed customer incidents. PaperCut has not yet publicly assigned or disclosed the technical identity of the flaw.

So this isn’t a recycled warning about an old CVE.

Something new is happening.

Bugstoday Opinion

This is the kind of security advisory administrators hate.

There is no comfortable CVE number to search for.

No CVSS score.

No public exploit analysis.

No finished patch.

Just one confirmed fact:

PaperCut knows customers have already been hit.

And that changes the equation.

Normally, defenders get a vulnerability disclosure first and attackers race to exploit it.

Here, the public information arrived after PaperCut had already confirmed customer incidents and reproduced the underlying vulnerability.

That doesn’t mean every PaperCut server is compromised.

It also doesn’t mean we should invent technical details that PaperCut hasn’t released.

But it does mean administrators should stop treating this as routine maintenance.

Bugstoday verdict: PaperCut NG/MF is under an active security cloud before the vulnerability even has a public technical identity. Confirmed customer incidents exist, the flaw has been reproduced, and the fix is still being built. For affected organizations, waiting for the CVE number may be the wrong mindset — start checking your exposure now.