PaperCut Emergency Patch: What Businesses Need to Do Now

PaperCut has issued a second emergency security patch for PaperCut NG and PaperCut MF after confirming that attackers are actively exploiting serious vulnerabilities. Businesses that installed the first emergency patch are being told to install Release 2 as well, because researchers found additional ways around the original protection.

The flaws can be chained to let an unauthenticated attacker change PaperCut settings and potentially run code on the print-management server. PaperCut says confirmed customer incidents have occurred and is treating the issue as an urgent security event.

If your organisation uses PaperCut NG or MF, particularly where its web interface can be reached from the internet, this needs checking now.

Update: Emergency Patch Release 3 is now available

Updated 2 September 2026: PaperCut has now released Emergency Patch Release 3 for PaperCut NG and MF. This supersedes Release 2, so organisations with internet-facing PaperCut Application Servers should install Release 3 even if Release 2 has already been applied.

PaperCut says Release 3 is cumulative, so there is no need to install the earlier emergency patches first. It fixes two known regressions from the previous release — broken SAML login flows and legacy Microsoft SQL Server driver support for external card lookups — and adds further hardening against attack chains seen in the wild.

The urgency has also increased. PaperCut says it is seeing a second wave of attacks against servers that remain publicly accessible or are not fully patched, with more sophisticated post-compromise behaviour than was seen earlier in the incident.

What businesses should do now

• If your PaperCut NG/MF Application Server is internet-facing, restrict access to trusted IP addresses immediately.
• Install Emergency Patch Release 3 on supported PaperCut NG/MF v24, v25 or v26 systems, even if Release 2 is already installed.
• Update Site Servers and secondary/print servers to a patched version as well — do not patch only the primary Application Server.
• Check PaperCut and endpoint-security logs for the indicators of compromise listed in PaperCut’s live advisory.
• If compromise is suspected, treat it as an incident: secure backups, rebuild the Application Server and restore from a known-clean backup rather than relying on patching alone.

PaperCut Hive, PaperCut Pocket, Mobility Print and Print Deploy are not affected by this specific advisory. The original article below explains the background to the incident and the Release 2 guidance that was current when it was published.

Read PaperCut’s live security advisory.

What has happened to PaperCut?

PaperCut published its initial urgent bulletin on 27 August 2026 after learning of active exploitation affecting PaperCut NG and MF. It released an emergency patch, but further work with Huntress and watchTowr uncovered extra bypasses and the need for additional hardening.

Emergency Patch Release 2 was published on 28 August. PaperCut recommends installing it even if the original emergency patch has already been applied.

The vendor has now identified two vulnerabilities:

• CVE-2026-81578 — an authentication-bypass vulnerability rated 8.8, which can allow an unauthenticated attacker to modify certain system configurations.
• CVE-2026-82078 — a critical unsafe class-loading vulnerability rated 9.4, which can enable arbitrary code execution if an attacker manipulates the relevant configuration.

Which PaperCut products are affected?

PaperCut says the advisory applies to all versions of PaperCut NG and PaperCut MF.

Emergency Patch Release 2 is available for versions 24, 25 and 26 on Windows, Linux and macOS. Organisations using version 23 or earlier are advised to upgrade to the latest supported version rather than wait for a separate patch.

Primary application servers, Site Servers and secondary or print servers should all be moved to a patched version. PaperCut says Print Deploy and Mobility Print are not affected by these two vulnerabilities.

What should businesses do now?

1. Identify whether PaperCut NG or MF is installed. Do not assume the office printer itself will show this clearly; PaperCut commonly runs on a separate server.
2. Check whether the PaperCut web interface is publicly accessible. PaperCut says internet-facing access should immediately be restricted to trusted IP addresses using firewall or network-access controls.
3. Install Emergency Patch Release 2. This applies even if the first emergency patch was installed.
4. Update Site Servers and secondary print servers. Patching only the primary server is not sufficient.
5. Review security and PaperCut logs. Look for suspicious activity involving pc-app.exe, missing or truncated server.log files and the specific database errors listed in PaperCut’s advisory.
6. Escalate suspected compromise. Preserve current backups and involve your IT or incident-response provider rather than simply patching and assuming the problem is resolved.

Could the emergency patch cause problems?

Possibly. PaperCut updated its bulletin on 29 August to say it was investigating reports that external database Card/ID lookups and SAML were not working as expected after patching.

That does not make delaying the security response a good option. It means the update should be planned and tested carefully, with authentication, card release and printing workflows checked immediately afterwards.

For most organisations, the safest sequence is to restrict public access first, confirm a usable backup, apply Release 2 and then test the services staff rely upon.

How can you tell whether a PaperCut server was attacked?

PaperCut’s current indicators include endpoint or network alerts involving the Application Server, suspicious activity from pc-app.exe, deleted or shortened log files, and unusual database errors. However, PaperCut warns that the absence of those signs does not prove a server is clean.

If compromise is suspected, PaperCut recommends securing backups, rebuilding the Application Server and restoring from a clean backup taken before the suspicious activity. This is more involved than installing a patch and should be handled as a potential security incident.

Managed monitoring and advanced endpoint protection can help expose unusual server behaviour, but they do not replace timely vendor patching and access controls.

Quick answers

Is PaperCut being actively exploited?

Yes. PaperCut says it is investigating active exploitation and is aware of confirmed customer incidents.

Do we need Release 2 if we installed the first patch?

Yes. PaperCut explicitly recommends installing Emergency Patch Release 2 even where the original emergency patch was already applied.

Does this affect PaperCut Hive or Pocket?

The urgent bulletin applies to PaperCut NG and MF. It says Print Deploy and Mobility Print are not affected by these vulnerabilities.

Should a PaperCut server be accessible from the internet?

PaperCut’s immediate advice is to restrict its web interfaces to trusted IP addresses and prevent access from untrusted internet addresses.

The important point

This is not a routine software update. There is confirmed exploitation, the first emergency fix required further hardening, and the affected software often sits on a server with access to business printing infrastructure.

Businesses should establish whether they run PaperCut NG or MF, restrict public access, install Release 2 and check for suspicious activity. If the server shows signs of compromise, treat it as an incident rather than relying on patching alone.

Sources

• PaperCut urgent NG/MF security bulletin — updated 29 August 2026.
• BleepingComputer: PaperCut releases second emergency patch.

This article reflects the vendor’s published position on 29 August 2026. PaperCut’s investigation is continuing, so affected organisations should check the live advisory for further updates.