PaperCut Warns of NG, MF Flaw Actively Exploited in Zero-Day Attacks

Summary

PaperCut Software issued an urgent security advisory on 27 August 2026 confirming active exploitation of a vulnerability affecting all versions of PaperCut NG and PaperCut MF. PaperCut is the print-management vendor widely deployed across schools, universities and enterprises, including in Australia and New Zealand, which makes this a high-relevance education and public-sector issue.

Technical detail

PaperCut confirmed that attackers are actively exploiting the flaw and released emergency patches for customers with public-facing servers. It urges organisations with internet-exposed Application Servers to restrict web-interface access to trusted IP addresses immediately. PaperCut shared indicators of compromise — including suspicious behaviour from the legitimate pc-app.exe process and missing or modified server.log files — but has been deliberately withheld details of the flaw itself, the threat actors and whether data is being stolen.

Significance (context)

PaperCut's own guidance notes that print management is a functional, recently noticed product layer that can be a gateway into a school or enterprise network. Historically, exploits of PaperCut functionality have served as an initial-access vector for ransomware, most notably the 2023 Clop/LockBit/Bl00dy Chains. Because the underlying flaw is a zero-day exploited in the wild, remediation will be time-critical: restrict web-interface access and install the emergency patch.

AU/NZ relevance

This is a genuinely direct issue for Australia and NZ. PaperCut is used pervasively across Australian and New Zealand schools and universities, and the NZ education and public-sector networks in particular where the same PP-issue hardening advice applies. Australian and New Zealand universities, schools and enterprises using PaperCut NG/MF should treat the emergency patches as a priority remediation item, restrict web-interface exposure, and monitor for the shared indicators of compromise without waiting for a technical detail disclosure.