Two Chained PaperCut Vulnerabilities Enable Unauthenticated Remote Code Execution

What Happened

According to a report from The Hacker News, attackers are actively exploiting a newly patched vulnerability in PaperCut NG and MF print management software. PaperCut has released an emergency fix with additional hardening in response. The flaw reportedly allows an unauthenticated attacker to gain remote control over PaperCut's trusted configuration, which could be leveraged to execute arbitrary Java code inside the application. The report indicates two flaws are being chained together to achieve code execution without authentication, though full technical details of both vulnerabilities were not included in the summary available at publication time.

Why It Matters

PaperCut NG and MF are widely deployed print management platforms used across enterprise, government, healthcare, and education environments. Prior PaperCut vulnerabilities have historically been attractive targets for ransomware affiliates and other financially motivated actors due to the software's broad footprint and privileged position on internal networks. An unauthenticated remote code execution chain — if accurately characterized — would allow initial access without any credentials, making internet-facing or improperly segmented PaperCut instances a high-value target for opportunistic scanning and exploitation.

What Defenders Should Do Now

• Identify all PaperCut NG/MF instances in your environment, including any exposed to the internet, and confirm their patch level against PaperCut's advisory.
• Apply the emergency fix referenced in the report as soon as it can be validated in your environment.
• Where patching cannot happen immediately, restrict network access to PaperCut admin/web interfaces to trusted management networks only.
• Review PaperCut application and web server logs for anomalous unauthenticated requests to configuration or admin endpoints, unexpected process spawning by the PaperCut service account, or unusual outbound connections originating from PaperCut hosts.
• Monitor for post-exploitation indicators consistent with prior PaperCut incidents, such as living-off-the-land execution (e.g., PowerShell or cmd spawned from the PaperCut Java process) and follow-on lateral movement.

Developing Story

This is based on a single vendor/media report and details are still emerging — specific CVE identifiers, affected version ranges, and full exploitation mechanics were not fully specified in the source material available at the time of writing. Defenders should treat this as an early warning and consult PaperCut's official advisory directly for authoritative guidance. Original source: The Hacker News.