PaperCut reports confirmed zero-day attacks exploiting a vulnerability in all versions of PaperCut NG and PaperCut MF. Organizations with Internet-exposed Application Servers should immediately restrict web-interface access to trusted IP addresses, apply emergency patches when other mitigation is unavailable, and investigate the indicators described in PaperCut's advisory.
What happened to PaperCut NG and MF?
PaperCut says its security response team is investigating active exploitation affecting PaperCut NG and PaperCut MF. The company reports confirmed customer incidents and says it reproduced the vulnerability using information provided by a university customer.
Which PaperCut versions are affected?
According to PaperCut, all versions of PaperCut NG and PaperCut MF are affected. The supplied source does not identify the vulnerability, explain its exploitation method, or name an assigned CVE.
What mitigation does PaperCut recommend?
Organizations with Internet-exposed PaperCut Application Servers should restrict access to their web interfaces using firewall rules or network access controls. PaperCut also released emergency patches for customers with public-facing servers who cannot take other mitigating action.
Which indicators of compromise should administrators review?
Administrators should investigate suspicious activity involving the legitimate pc-app.exe process and check whether server.log files were modified, deleted, or are missing. PaperCut also identified these errors for review:
- ERROR No suitable driver found for jdbc:no:x
- ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST
PaperCut warns that absence of these indicators does not prove that a server was not compromised.
What remains unknown?
The supplied report says PaperCut has not disclosed who is behind the attacks, what attackers do after compromise, or whether data is being stolen. PaperCut is expected to update its advisory with additional indicators of compromise and remediation information.
What should organizations do now?
- Restrict Internet access to PaperCut web interfaces using trusted IP allowlists, firewall rules, or network access controls.
- Apply PaperCut's emergency patch when public-facing exposure cannot be otherwise mitigated.
- Review process activity, server.log status, and the listed error messages.
- Treat missing indicators as inconclusive and continue investigating possible compromise.
- Monitor PaperCut's security advisory for further indicators and guidance.