Emergency PaperCut Advisory: Active Zero-Day Campaign Targets Print Servers

If you have a PaperCut application server sitting on the public internet, stop what you are doing and restrict network access immediately. PaperCut Software has issued an urgent advisory warning of active, in-the-wild exploitation targeting both PaperCut NG and PaperCut MF, accompanied by out-of-band emergency security patches.papercut

Active Exploitation and Flaws

Security teams at PaperCut, Huntress, and watchTowr confirmed that attackers are actively chaining two newly disclosed vulnerabilities to compromise print servers. The attack vector allows an unauthenticated adversary to bypass access controls and achieve remote code execution under the context of the PaperCut server process.

When chained together, an unauthenticated attacker can manipulate database driver configurations remotely, instantiate malicious Java classes residing on the application classpath, and execute arbitrary operating system commands.papercut

What Attackers Are Doing

Telemetry and forensic data from affected environments reveal a consistent post-compromise routine once attackers pop the pc-app.exe server process.papercut

• The PaperCut process spawns cmd.exe to run early reconnaissance commands such as whoami & ver, tasklist, and nltest /dclist:.papercut

• Attackers pull secondary payloads to C:\ProgramData, including temporary execution binaries.papercut

• Persistence is established via rogue remote access tools, specifically installing a Windows service called "Remote Access Service" (a SimpleHelp agent running SimpleService.exe) or staging AnyDesk.papercut

• Log tampering is common, including deleted, missing, or unexpectedly truncated server.log files.papercut

Indicators of Compromise

Administrators should inspect their application servers for specific file and log artifacts.papercut

• Look in server.log for strings matching jdbc:derby:memory:pwn;create=true, VALUES CAST(X'cafebabe', or DB Driver: <5-char random name>.papercut

• Check for temporary files on disk matching <install>\server\lib\<5-char-name>.class or scripts inside <install>\server\data\content\.papercut

• Audit Windows services for unexpected entries running SimpleService.exe under LocalSystem.papercut

• Query EDR and SIEM tools for any child processes spawned directly by pc-app.exe or pc-app.papercut

Emergency Patching and Remediation

Because this is an active zero-day campaign, PaperCut bypassed its standard release cycle to publish hotfixes across versions 24, 25, and 26.

If you find you have any indication of compromise its recommended to isolate the server, wipe and rebuild.

Details: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory