PaperCut Rushes a Third Patch as Print Servers Fall

PaperCut shipped a third emergency patch on Sept. 1 after attackers chained two print-server bugs into a no-login takeover. The first two fixes did not hold.

Once inside, the same hosts ran domain lookups and quietly installed remote-access tools. A print box with a public IP is now a foothold, not a queue.

Two Bugs Open a No-Password Foothold

PaperCut NG and PaperCut MF, the company’s print-management products, are treated as affected in every version. The pair of flaws only needs a reachable address. John Hammond, senior principal security researcher at Huntress, called the chain a “point and shoot” full compromise: no username, no password, just an IP or hostname.

THE TWO FLAWS

Huntress reproduced the full pre-auth chain against a stock PaperCut NG 25.0.11.75758 server and spawned charmap.exe as SYSTEM under pc-app.exe. Rapid7 mapped the same path: the login bypass reaches the config editor, rewrites the external card-lookup driver, then a search request fires the malicious load.

Chris, PaperCut’s founder and CEO, said the chain was not a bad library. It used a rarely touched feature that looks up card numbers in an outside database, then mixed driver loading, file writes, and Java class loading to drop a payload.

The First Two Patches Did Not Hold

The first education-sector report landed at 9:42 a.m. AEST on Thursday, Aug. 27. By midday PaperCut had declared a P0 incident. A second organization in the same region called at 5:05 p.m. with cleaner logs, which let the vendor reconstruct the chain.

THE PATCH CLOCK

1. Aug. 27, 2026: Publishes the first urgent bulletin and asks customers to pull internet-facing Application Servers off the public web.
2. Aug. 28, 2026, 02:10 AEST: Ships the first emergency patch for v25 and v26.
3. Aug. 28, 2026, 8:42 p.m. AEST: Ships Release 2 with extra hardening after Huntress and watchTowr found bypasses, and extends fixes to v24.
4. Sept. 1, 2026, 6:22 p.m. AEST: Ships Release 3, which supersedes both earlier builds, restores SAML login and legacy Microsoft SQL Server card-lookup drivers, and adds more hardening.

Rapid7 was blunt on Sept. 1: shops that installed Release 1 or Release 2 are not fully protected and must install Release 3 at once. The first fix could be bypassed by pointing the forged request at the Home page instead of the Error page. Hammond said Huntress’s proof of concept stopped working against Release 2; the vendor still pushed a third build four days after the first, after two known regressions and more attack-path work.

Chris wrote that the company chose useful protection fast over one polished release, because the 2023 wave taught them the second group of attackers can be worse than the first. Manual printer-hardware tests were skipped so public servers could get a block. The current Release 3 builds and checksums are 76531, 76532, and 76534 for MF v26, v25, and v24, and 76530, 76533, and 76535 for NG. Site servers and secondary print servers need the same build as the Application Server.

What Happens After the Print Server Falls

On hosts where endpoint tools did not stop the payload, PaperCut logged a climb from a simple whoami to a persistent remote-access service in under 22 minutes, then an AnyDesk installer a few minutes later. That is the part that outruns a print-queue outage: the box becomes a beachhead for domain recon and hands-on control.

Huntress saw two customer cases. One on Aug. 26 lasted under two minutes on PaperCut MF 25.0.10.75465 and ran the base64 string for whoami & ver. The second, on Aug. 27 against MF 24.1.5.71847, added tasklist. Both looked like scouting. Rapid7 told a different story in shops it is handling: attackers brought their own remote-management tools, tried to raise privileges, and tried to move laterally. Seth Lazarus, senior manager of detection and response services at Rapid7, said that pattern is already in play.

THE FOLLOW-ON PAPER CUT LOGGED

• 00:00:00: whoami & ver to learn the account and Windows version.
• 00:01:19: tasklist to list running processes.
• 00:04:42: nltest /dclist: to enumerate domain controllers.
• 00:06:09: quser and a listing of C:\Users.
• 00:16:07: PowerShell download of ace.exe from sendit.sh into C:\ProgramData.
• 00:19:27: Silent run of ace.exe, then a “Remote Access Service” (SimpleHelp) installed as LocalSystem, set to auto-start, at 00:21:29.
• 00:27:37: Download of AnyDesk.exe into C:\ProgramData.

Huntress also recovered hex-encoded Java.class files dropped under server\lib, including Udydn.class, which ran commands, wrote Udydn.out, then deleted its output and the server.log file. A high-confidence breadcrumb is a Derby boot of an in-memory database named pwn. PaperCut’s bulletin lists the same family of clues: jdbc:derby:memory:pwn, “No suitable driver found for jdbc:no:x”, five-character.class files under server\lib, and.cmd/.out files under server\data\content. Attackers can wipe those files. Missing logs are a lead, not a clearance.

The exploit technique is chaining these two flaws together for a “point and shoot” full compromise.

John Hammond, senior principal security researcher, Huntress

Rapid7 published a Metasploit module on Aug. 31, which lowers the skill needed to test, or abuse, the same chain. Honeypot operators have also described a quieter misuse of the login bypass: hijacking the external user-lookup to dump database tables through Derby rather than racing straight to a shell. PaperCut has not called that path confirmed.

Almost Half of Tracked Installs Cannot Patch

Emergency builds exist only for v24, v25, and v26. Huntress’s second case was on v24.1.5, which had no public fix until Release 2. The uglier remainder sits further back.

HUNTRESS FLEET SNAPSHOT

• Tracked installs: About 2,500 PaperCut deployments in the Huntress customer set.
• Unpatchable share: 47 percent are on v23 or older, with no emergency build.
• Vendor path: PaperCut tells those shops to upgrade to the latest version rather than wait for a backport.
• Scope: The advisory applies to all NG and MF versions, including hosts with no suspicious logs yet.

An upgrade across a major version is a change window, not a hot-fix. Print servers are often owned by facilities or classroom IT, not the team that watches the firewall. That split is how a v22 box stays on a public IP while the security group patches laptops.

Schools Were the First Call Again

The first customer call at 9:42 a.m. came from an education customer running PaperCut MF. Its DFIR team isolated the virtual machine fast enough to keep the logs that hinted at the path. That sector is not a coincidence of one bad morning.

In 2023, CVE-2023-27350 gave unauthenticated code execution on PaperCut NG and MF. PaperCut patched it in March. Attackers started using it in mid-April. The FBI and CISA’s 2023 advisory on education-sector attacks said education facilities held about 68 percent of exposed, though not necessarily vulnerable, U.S. PaperCut servers. The Bl00dy ransomware group hit those networks in early May. Other crews, including LockBit affiliates and Cl0p-linked actors, used the same door. Some dropped legitimate remote-management software, the same class of tool showing up again now.

One of the biggest lessons from that incident was that the first attacker is not necessarily the biggest part of the problem.

Chris, founder and CEO, PaperCut, Sept. 1 note to customers

Chris also put his name on the new login bypass. He wrote that the opening move came from code he had contributed over the years, and that long-lived, pen-tested code can still combine with other features in a way nobody planned. After 2023 the company added in-product emergency alerts and a security mailing list. Those channels are how the Aug. 27 warning went out. They did not find this chain in the post-2023 audit pass.

Federal Agencies Have Until Sept. 14

CISA added both flaws to the KEV catalog on Aug. 31, with a Sept. 14 due date for federal civilian executive branch agencies. Both entries say ransomware use is unknown. Binding Operational Directive 26-04 tells those agencies to treat KEV items on public assets that give total control after a break-in as a short-fuse job, and to check whether anyone got in before the patch landed.

Private shops are not bound by that date. They face the same internet scanners. Twelve days remain from today, Sept. 2, until the federal cut-off. PaperCut’s bulletin, last updated today, still calls the investigation active and says a fully QA’d maintenance release is in progress. Further emergency builds are not ruled out.

Pull the Application Server Off the Internet

The vendor’s first instruction has not changed since Aug. 27: if the Application Server’s web interfaces are reachable from untrusted addresses, restrict them to trusted IPs now, patched or not. Firewall rules, a VPN, or an allow-list beat a hot-fix that already had two sequels. watchTowr, which reproduced the bugs and the first-patch bypasses, put the same advice in public on Aug. 31.

https://x.com/watchtowrcyber/status/2094437662757150990

The reason those interfaces stay public is often mundane. Staff want to send jobs from a sofa at home, so the print admin portal sits on the open internet. That convenience is how a no-login bug becomes a domain-controller lookup.

IF YOU RUN PAPERCUT NG OR MF

• Contain first: Block untrusted access to the Application Server web UI, then install Release 3 even if Release 1 or 2 is already on the box.
• Older than v24: There is no emergency build; upgrade to a current supported version and keep the server off the public internet until that finishes.
• Hunt for the stay-behind: Look for a Windows service named Remote Access Service running SimpleService.exe, unexpected AnyDesk, pc-app.exe launching cmd.exe, and the Derby pwn strings in whatever logs remain.
• If you think it was hit: Secure current backups, wipe and rebuild the Application Server, and restore a clean backup taken before the odd behavior. PaperCut says it cannot size the blast radius from the outside.

Chris’s Sept. 1 note still called the incident active. Release 3 is the build to verify today, and any server that was on the public internet before that build landed should be treated as a crime scene, not a printer.