PaperCut Releases Emergency Patch for Exploited Zero-Day

PaperCut NG and MF print management solutions are affected by a zero-day vulnerability that allows unauthenticated remote attackers to control the application's trusted configuration and execute arbitrary Java code inside the application process. The vendor has released emergency patches and recommends disconnecting the application server from the internet and restricting access to trusted IPs. Indicators of compromise include suspicious activity involving pc-app.exe and modifications to server.log files. The vulnerability has been assigned CVE-2026-81578 and CVE-2026-82078. No technical details about the vulnerability's root cause have been publicly disclosed. The exploitation is confirmed in customer environments, and the investigation is ongoing.

The vulnerability enables unauthenticated remote attackers to gain control over PaperCut's trusted configuration and execute arbitrary Java code within the application process, potentially allowing full compromise of the affected system. Attackers have been observed exploiting this flaw in the wild, with confirmed customer incidents. The manipulation or deletion of log files indicates attempts to evade detection. Given the critical nature of arbitrary code execution and remote control, this vulnerability poses a significant risk to affected organizations.

PaperCut has released emergency patches that users of NG and MF solutions should install immediately. The vendor also recommends disconnecting the application server from the internet and restricting access to trusted IP addresses to reduce exposure. Monitoring for suspicious activity related to pc-app.exe and checking for truncated or deleted server.log files can help detect potential intrusions. Since the vendor has provided an official fix, applying the patch is the primary remediation step.