SURIQ
A print server is not where most teams look for their next total compromise. That is exactly why this one matters. PaperCut is warning that attackers are actively exploiting a flaw in its NG and MF print management software that lets an unauthenticated request run code on the server itself, and the company is treating every currently supported version as potentially affected.
The company said it recreated the flaw internally from details shared by a university customer's own security and forensics responders, and that it has confirmed incidents at customer sites. There is no CVE identifier yet and no published CVSS score. What there is instead is in-the-wild exploitation and a fix that shipped in a hurry.
The timeline is the story. Security firm Huntress reported that it caught the flaw being used against two of its customers, the first case on August 26 and a second the next day, and said one of those intrusions ran its course in under two minutes. PaperCut published its urgent advisory on August 27, and at 02:10 AEST on August 28 it released emergency, out-of-cycle builds. That is a patch-to-exploitation gap measured in hours, not the weeks defenders usually get.
Why a print server is a worse target than it sounds
Two things make PaperCut a high-value beachhead, and neither is obvious from the words "print management." First, the PaperCut Application Server is a web application, and plenty of organizations expose its admin and user portals to the internet so remote and roaming users can release print jobs. A flaw that needs no authentication turns that convenience into a front door. Second, on Windows the PaperCut service runs as the local SYSTEM account, and on Linux it typically runs with high privilege. Code execution through the application is not a foothold in a sandbox, it is control of the host at the top privilege level.
Put those together and a compromised print server is a quiet, trusted machine sitting inside education, healthcare, and enterprise networks, already running as the most powerful account on the box. According to Huntress, one observed intrusion spawned charmap.exe under the PaperCut process pc-app.exe running as SYSTEM, and dropped Java class files into the server's library directory. That is what "total takeover" looks like in practice: the attacker inherits everything the print server can reach.
Patch closes the door. Hunt for what already walked through.
Applying the fix stops the next request. It does nothing about the request that already landed during the days this was a live zero-day, and a two-minute intrusion is easy to miss if all you do is install the update and move on. Treat patched and clean as two separate claims, and prove the second one.
Do the containment step first, because it holds even before you patch every server. PaperCut's own guidance is to limit who can reach the Application Server web interface, allowing only known-good IP ranges through the firewall or a VPN and blocking everyone else. Any PaperCut portal reachable from the open internet should come off it now.
Then hunt. The indicators Huntress and PaperCut have published are concrete enough to search for tonight:
- Unexpected child processes under
pc-app.exe, especially anything spawning a shell or a utility likecharmap.exeas SYSTEM. - New or unfamiliar Java class files written into the PaperCut server library directory, for example under
server\lib, that no upgrade put there. - Server log entries that read
DB URL: jdbc:derby:memory:pwn,ERROR No suitable driver found for jdbc:no:x, or a database error looking up cardID with aVALUES CASTstring. - A
server.logthat is missing or has been unexpectedly truncated, which can indicate an attacker cleaning up. - Outbound SMB connections from the PaperCut host, which has no business initiating them in most environments.
- Short bursts of built-in reconnaissance from the print server, such as encoded commands that resolve to basic host and process enumeration, a common first move once code runs.
If any of those turn up, preserve logs, the process tree, and reverse-proxy records before you re-image, because patching over a live compromise just hides it.
PaperCut's second turn as a ransomware on-ramp
This is not the first time PaperCut has been the way in. In 2023, CVE-2023-27350 let unauthenticated attackers run code on PaperCut servers, and it was picked up broadly, including by the Clop and LockBit ransomware operations and by state-linked actors. The pattern holding across both events is the lesson worth keeping: internet-exposed infrastructure that runs at high privilege and rarely makes anyone's priority patch list is precisely what ransomware crews and access brokers hunt for. Print, backup, and management servers are soft not because the code is uniquely weak, but because nobody treats them as tier-zero exposure. We made a similar point in June about a separate flaw in PaperCut's Windows print client: the product keeps landing on the wrong side of that gap. This is the second reminder in three years that PaperCut belongs on the tier-zero list.
What defenders should do now
Fixed builds shipped for the version 25 and 26 branches across Windows, Linux, and macOS, with a version 24 build still in progress at the time of writing. Exact build numbers differ by branch and platform, so check PaperCut's advisory for the one that matches your install rather than trusting a single string; Huntress listed the version 25 Windows fixes as NG 25.0.12.76497 and MF 25.0.12.76496. Restrict the web interface, upgrade to the emergency build for your branch, and then hunt the window that is already behind you. On a flaw that went from first observed attack to public warning to emergency patch inside about 48 hours, the servers that stay exposed are the ones that get found.