- Published on
PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
- Authors
- Name
- DeepHorus
Print management software company PaperCut has issued an urgent security alert regarding an actively exploited zero-day vulnerability affecting all versions of its PaperCut NG and PaperCut MF software. The company confirmed that bad actors are leveraging the flaw in real-world attacks, prompting the release of an emergency patch for versions 25 and 26.
The vulnerability impacts the core application server component of PaperCut's widely used print management solutions. PaperCut stated it is "aware of confirmed customer incidents and is treating this matter with the highest priority," with an investigation currently underway. The immediate priority is to protect organizations using the software.
At this time, the specific technical details of the flaw, the methods of exploitation, and the threat actors behind the campaign remain unknown. However, PaperCut has provided several indicators of compromise to help organizations detect potential breaches. These include alerts from security tools involving suspicious activity from the "pc-app.exe" process and specific error entries in server log files.
The company has issued a critical mitigation directive for all customers. Users are strongly advised to immediately restrict access to their PaperCut NG/MF Application Server if it is exposed to the internet. PaperCut emphasized that this action should be taken now, even in the absence of observed suspicious activity.
This incident is not the first time PaperCut software has been a target for critical vulnerabilities. In 2023, a different critical flaw (CVE-2023-27350) was actively exploited by Russian threat actors and the financially motivated group Lace Tempest. That attack was used to deploy Cl0p and LockBit ransomware, highlighting the ongoing risk associated with the platform.
The current zero-day event underscores the persistent vulnerability of enterprise software to sophisticated attacks. While patches are now available for the most recent versions, the lack of details on the flaw's scope and the absence of patches for older versions leave many organizations at risk. The situation remains fluid as the investigation progresses, and further guidance from PaperCut is anticipated.
