PaperCut, the print management platform sitting inside universities, hospitals and corporate networks around the world, is being broken into right now, and the way in does not need a password.
PaperCut Software published an urgent advisory on 27 August 2026 saying it was investigating active exploitation of a flaw in PaperCut NG and PaperCut MF, that it had confirmed customer incidents, and that it was treating the issue as a security emergency. No CVE identifier has been assigned yet, and no CVSS score has been published. PaperCut says information from a university customer's security team and its incident response firm is what let the vendor reproduce the bug at all.
A doorman who only checks the front page
Rapid7 and Huntress have both published their own analysis, and they agree on the shape of it. PaperCut runs on the Apache Tapestry web framework, whose "complex direct" request format lets one request name the page to display and a different page whose component should actually run. PaperCut's permission check looks at the page being displayed and misses the one doing the work. Point the displayed page at the public Error page, and an unauthenticated request reaches administrative components it should never touch.
From there it becomes code execution. According to Rapid7's Emergent Threat Response write-up, the attacker uses that bypass to rewrite the four settings that connect PaperCut to an external card database, pointing them at a database they control. Triggering a user search then runs their SQL. PaperCut ships Apache Derby, whose foreignViews feature can be talked into opening an attacker-supplied connection that creates a JavaScript-backed database trigger, and PaperCut also bundles the Nashorn JavaScript engine, so that trigger can start an operating system process.
Two minutes was enough
Huntress has seen the attack land in two customer environments, and says one intrusion on 26 August lasted under two minutes end to end. The attackers ran base64 encoded commands that decoded to whoami & ver, and in the second case whoami & ver & tasklist, asking the server who it was running as, what Windows version it was, and what else was running. A hex encoded Java class file arrived the same way and landed in the PaperCut directory as lib/Udydn.class. Decompiled, it profiles the machine, lists files, then deletes its own output and the PaperCut and Derby logs behind it.
Huntress separately rebuilt the full chain against a stock install of PaperCut NG 25.0.11.75758 and used it to spawn a process running as SYSTEM under the PaperCut application server. Their proof of concept pulled the Derby archive from an attacker-controlled SMB share, which is reason enough to watch outbound SMB from these boxes. PaperCut has been targeted before: CVE-2023-27350 was exploited at scale in 2023, ransomware crews included, which fits a pattern security teams have watched all month as espionage groups and ransomware affiliates queue up behind the same internet-facing appliances.
Patch to 25.0.12, or take it off the internet
PaperCut released emergency builds on 28 August for versions 25 and 26. On Windows those are PaperCut NG 25.0.12.76497 and PaperCut MF 25.0.12.76496. A version 24 fix was still in development at the vendor's latest update, and PaperCut treats every version of NG and MF as potentially affected. These builds skipped the normal release process and are aimed at customers with public-facing servers who cannot otherwise reduce exposure. If you cannot patch now, restrict the web interface to trusted internal ranges or put it behind a VPN, and preserve the logs directory, the configuration and the endpoint process tree before you upgrade or restart.
In server.log, watch for the strings ERROR No suitable driver found for jdbc:no:x, ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST, and DB URL: jdbc:derby:memory:pwn. A missing or truncated server.log is itself a finding, because the payload deletes it, and on the endpoint look for unexpected child processes under pc-app.exe. PaperCut has published no malicious addresses or domains yet, and says plainly that their absence is not evidence a server is clean.
The uncomfortable part is not the exploit chain. It is that a print server, the least interesting box in most estates, turned out to be an unauthenticated path to SYSTEM on a machine that talks to directory services, databases and every printer in the building.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.