PaperCut NG/MF Actively Exploited Flaws: Patch to 26.0.5, 25.0.13, or 24.1.10 — Detection and Remediation Guide

PaperCut has released new Regular Maintenance Releases (MR) for its NG/MF print management platform — versions 26.0.5, 25.0.13, and 24.1.10 — that formally replace the emergency patches previously pushed to customers to address two security flaws that have come under active exploitation in the wild.

If your organization runs PaperCut NG or MF anywhere in the environment — and in education, healthcare, legal, and managed print environments it is nearly ubiquitous — this is a drop-everything patch event. Print management servers are not peripheral assets. They are typically domain-joined, hold print queue data that can contain sensitive documents, run with elevated service privileges, and historically have been a proven initial-access vector for ransomware operators and initial access brokers. When a vendor tells you a flaw is being actively exploited and replaces emergency patches with consolidated maintenance releases, the subtext is clear: exploitation pressure is sustained enough that piecemeal hotfixes were no longer the right vehicle.

This post breaks down what defenders need to know: affected versions, how to validate your patch state, what to hunt for while you patch, and how to harden PaperCut deployments going forward.

What Happened

On Thursday, PaperCut announced the availability of three new maintenance releases across its supported version trains:

• PaperCut NG/MF 26.0.5
• PaperCut NG/MF 25.0.13
• PaperCut NG/MF 24.1.10

These releases supersede and replace all previously published emergency patches addressing two security vulnerabilities that are being actively exploited. The vendor has been explicit that customers should move to these maintenance releases rather than rely on the interim hotfix state. This matters for one practical reason: emergency patches are often manually applied, inconsistently deployed across fleets, and difficult to audit. A formal maintenance release gives you a clean, version-attestable patch state — something your vulnerability management program and your auditors both need.

PaperCut has not always assigned public CVE identifiers at initial disclosure for flaws under active exploitation, and at the time of this writing the two flaws are tracked via PaperCut's own security bulletin. Defenders should monitor the vendor advisory for CVE assignment and CVSS scoring as they are published, and should treat both flaws as critical-severity until told otherwise — active exploitation is the only severity signal that matters in the near term.

Why PaperCut Is a Priority Target

Veteran responders will remember that PaperCut NG/MF has been a ransomware initial-access vector before. Threat actors target print management platforms for a specific set of reasons:

1. Privileged positioning. The PaperCut Application Server typically runs as a service with significant local privileges and is frequently installed on domain-joined Windows servers.
2. Web-facing administrative surfaces. The admin and user web interfaces (default ports 9191/HTTP and 9192/HTTPS) are sometimes exposed well beyond where they should be — including directly to the internet in poorly governed environments.
3. Java-based attack surface. The application server runs on a bundled Java runtime, and exploitation frequently manifests as the Java process spawning unexpected child processes — a high-fidelity detection opportunity.
4. Delayed patching culture. Print infrastructure is operationally sensitive. Teams defer reboots and upgrades, which is exactly the dwell time attackers bank on.

If your PaperCut application server is reachable from the internet today, assume it has already been scanned and likely probed for these flaws.

Technical Analysis

Affected Products and Versions

Anything below these build numbers on the respective version trains — including systems that received the manual emergency patches — should be upgraded to the corresponding maintenance release. Older, end-of-support trains should be treated as vulnerable and migrated to a supported release immediately.

Exploitation Status

• Confirmed active exploitation in the wild. This is not a theoretical or proof-of-concept scenario. PaperCut's decision to consolidate emergency patches into maintenance releases reflects sustained exploitation pressure.
• Public exploit availability: Expect weaponized exploitation to follow the patch diff. Once a vendor ships fixes, reverse engineering the delta between patched and unpatched builds is a matter of days for capable actors. Your patching window is now measured in days, not weeks.
• CISA KEV: Monitor the CISA Known Exploited Vulnerabilities catalog for additions tied to this disclosure. If added, federal civilian agencies will face a binding remediation deadline under BOD 22-01, and the KEV listing should be treated as a forcing function for private-sector prioritization as well.

Defender's View of the Attack Chain

Based on how exploitation of PaperCut NG/MF application-server flaws has historically unfolded, defenders should model the attack chain as follows:

1. Reconnaissance and access: Unauthenticated or weakly authenticated HTTP(S) requests to the PaperCut web interface on TCP 9191/9192, often targeting administrative or setup endpoints.
2. Exploitation: A crafted request against a vulnerable component of the application server, resulting in code execution within the context of the PaperCut service (a bundled Java process on the host).
3. Post-exploitation: The Java/application-server process spawns child processes — cmd.exe, powershell.exe, scripting engines — to stage tooling, enumerate the host and domain, and establish persistence or remote access (commonly via RMM tooling or webshell-like mechanisms dropped to the PaperCut installation directory).
4. Expansion: Credential access, lateral movement to the domain, and eventual ransomware deployment or data staging.

The single most reliable behavioral signal across this chain is the PaperCut server process spawning command interpreters or scripting engines. A healthy PaperCut application server essentially never does this.

Detection and Hunting

The detections below are built around the observable behaviors of PaperCut application-server exploitation: anomalous child processes of the Java/application-server process, suspicious network interaction with the PaperCut web ports, and file writes consistent with webshell or tooling drops into the PaperCut installation path. They are written to be low-noise in a typical environment — but validate against your own baseline before pushing to production blocking logic.

Sigma Rules

---
title: PaperCut Application Server Spawning Command Interpreter
id: 3f8c2a71-9d4e-4b6a-a51f-2c7e9d1b8a04
status: experimental
description: Detects the PaperCut NG/MF application server (Java-based pc-app process) spawning command shells or scripting engines, a high-fidelity indicator of post-exploitation activity following application server compromise.
references:
  - https://thehackernews.com/2026/09/papercut-replaces-emergency-patches.html
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\pc-app.exe'
  selection_parent_path:
    ParentImage|contains:
      - '\PaperCut NG\'
      - '\PaperCut MF\'
      - '\papercut\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent_path and selection_child
falsepositives:
  - Rarely, PaperCut support-directed diagnostic scripts executed via the application server
level: critical
---
title: Webshell or Tool Dropped in PaperCut Installation Directory
id: 8a1d4f62-3b7c-4e95-b208-6f3a1c9d5e17
status: experimental
description: Detects creation of script, JSP, or executable files within PaperCut NG/MF web-accessible installation paths, consistent with webshell or post-exploitation tooling deployment.
references:
  - https://thehackernews.com/2026/09/papercut-replaces-emergency-patches.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\PaperCut NG\'
      - '\PaperCut MF\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.asp'
      - '.aspx'
      - '.php'
      - '.war'
      - '.bat'
      - '.ps1'
      - '.exe'
      - '.dll'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate PaperCut upgrade or maintenance activity writing files to the installation directory — correlate with change windows
level: high
---
title: Inbound Connection to PaperCut Web Interface from External Source
id: c5e9b3d8-1a6f-47d2-9e34-8b2c5f7a1d96
status: experimental
description: Detects inbound network connections to PaperCut NG/MF administrative web ports (9191/9192) originating from non-internal address space, indicating potential external exposure or exploitation attempts.
references:
  - https://thehackernews.com/2026/09/papercut-replaces-emergency-patches.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort:
      - 9191
      - 9192
  selection_image:
    Image|contains:
      - '\papercut\'
  filter_internal:
    SourceIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
      - '127.'
  condition: selection_port and selection_image and not filter_internal
falsepositives:
  - Misconfigured NAT or load balancer health checks appearing as external sources
level: high

KQL — Microsoft Sentinel / Defender

This query hunts for the PaperCut application server process spawning command interpreters or reconnaissance tooling — the highest-fidelity post-exploitation signal — and also surfaces anomalous network connections to PaperCut web ports ingested via firewall CEF/Syslog.

let papercutProcs = dynamic(["java.exe", "javaw.exe", "pc-app.exe"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "whoami.exe", "net.exe", "nltest.exe", "curl.exe"]);
let childProcEvents = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (papercutProcs)
| where InitiatingProcessFolderPath has_any ("PaperCut NG", "PaperCut MF", "papercut")
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, SHA256;
let netEvents = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where LocalPort in (9191, 9192)
| where RemoteIPType == "Public"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, LocalPort, ActionType;
childProcEvents
| union netEvents
| order by TimeGenerated desc

If you ingest PaperCut application server access logs or perimeter firewall data into Sentinel via CommonSecurityLog, also hunt for authentication-bypass-consistent request patterns:

CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationPort in (9191, 9192)
| where RequestMethod == "POST" or RequestURL has_any ("/app", "/admin", "/api", "/setup")
| summarize RequestCount = count(), UniqueSources = dcount(SourceIP) by RequestURL, SourceIP, DestinationHostName, bin(TimeGenerated, 1h)
| where RequestCount > 50 or UniqueSources > 20
| order by RequestCount desc

Velociraptor VQL

Use this artifact across your server fleet to (a) identify PaperCut installations and their running versions, and (b) surface suspicious child processes of the PaperCut application server for triage.

-- Identify PaperCut processes, version artifacts, and suspicious child processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       get_member(object=pslist(pid=Ppid), member='Name') AS ParentName,
       get_member(object=pslist(pid=Ppid), member='Exe') AS ParentExe
FROM pslist()
WHERE (Exe =~ '(?i)papercut' OR Name =~ '(?i)pc-app|java')
   OR (ParentExe =~ '(?i)papercut|java' AND Name =~ '(?i)cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|whoami|net.exe')

Complement this with a file-system sweep for recently written scripts or binaries inside PaperCut web-accessible paths:

-- Hunt for recently modified executables/scripts inside PaperCut installation directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Program Files/PaperCut NG/**/*.jsp',
                 'C:/Program Files/PaperCut NG/**/*.exe',
                 'C:/Program Files/PaperCut NG/**/*.ps1',
                 'C:/Program Files/PaperCut NG/**/*.bat',
                 'C:/Program Files/PaperCut MF/**/*.jsp',
                 'C:/Program Files/PaperCut MF/**/*.exe',
                 'C:/Program Files/PaperCut MF/**/*.ps1',
                 'C:/Program Files/PaperCut MF/**/*.bat',
                 '/opt/papercut/**/*.jsp',
                 '/opt/papercut/**/*.sh'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

Patch Verification and Exposure Audit Script

Run this against your Windows-hosted PaperCut application servers to enumerate the installed version, confirm service state, and check whether the web interface is listening on all interfaces (a common accidental-exposure condition).

# PaperCut NG/MF patch-state and exposure audit
$installPaths = @("C:\Program Files\PaperCut NG", "C:\Program Files\PaperCut MF")

foreach ($path in $installPaths) {
    if (Test-Path $path) {
        Write-Host "[+] Found PaperCut installation at $path"
        # Extract version from the server version file
        $verFile = Get-ChildItem -Path $path -Recurse -Filter "version.txt" -ErrorAction SilentlyContinue | Select-Object -First 1
        if ($verFile) { Write-Host "    Version file: $(Get-Content $verFile.FullName -Raw)" }

        # Report on the pc-app binary timestamp as a proxy for patch recency
        $appExe = Get-ChildItem -Path $path -Recurse -Filter "pc-app.exe" -ErrorAction SilentlyContinue | Select-Object -First 1
        if ($appExe) {
            $vi = $appExe.VersionInfo
            Write-Host "    pc-app.exe version: $($vi.ProductVersion) | LastWrite: $($appExe.LastWriteTime)"
        }
    }
}

# Confirm the PaperCut service state
Get-Service -Name "PCAppSvc","PaperCut*" -ErrorAction SilentlyContinue |
    Select-Object Name, Status, StartType | Format-Table -AutoSize

# Exposure check: is the PaperCut web port bound to 0.0.0.0 (all interfaces)?
Get-NetTCPConnection -LocalPort 9191,9192 -State Listen -ErrorAction SilentlyContinue |
    Select-Object LocalAddress, LocalPort, OwningProcess,
        @{N='ProcessName';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
    Format-Table -AutoSize

Write-Host "[!] Required fixed builds: 26.0.5 / 25.0.13 / 24.1.10 — anything lower is vulnerable."

For Linux-hosted PaperCut application servers:

#!/bin/bash
# PaperCut NG/MF Linux patch-state and exposure audit
PC_DIR="/opt/papercut"

if [ -d "$PC_DIR" ]; then
  echo "[+] PaperCut installation found at $PC_DIR"
  grep -r "version" "$PC_DIR/server/version.txt" 2>/dev/null || \
    find "$PC_DIR" -maxdepth 2 -name "*.properties" -exec grep -il version {} \;
fi

echo "--- Listening state on PaperCut web ports ---"
ss -tlnp | grep -E ':9191|:9192'

echo "--- PaperCut process tree (look for unexpected children) ---"
PC_PID=$(pgrep -f "pc-app\|papercut" | head -5)
for pid in $PC_PID; do pstree -p "$pid"; done

echo "[!] Required fixed builds: 26.0.5 / 25.0.13 / 24.1.10"

Remediation

1. Patch immediately. Upgrade to PaperCut NG/MF 26.0.5, 25.0.13, or 24.1.10 depending on your version train. Do not remain on the manually applied emergency-patch state — the maintenance releases replace those patches and give you an auditable, vendor-supported baseline. Download the releases from the official PaperCut portal and consult the vendor's security bulletin for the two addressed flaws.

2. Assume compromise on internet-exposed servers. If your PaperCut application server was reachable from the internet while unpatched, patching alone is not sufficient. Hunt using the detections above, review PaperCut application server and access logs for anomalous requests to administrative endpoints, and check for persistence: new local accounts, scheduled tasks, unfamiliar services, RMM tooling, and unexpected files in the installation directory. If you find any indicator, treat it as a full incident and engage your IR process — this exploitation class has historically led to ransomware deployment.

3. Remove external exposure. The PaperCut admin interface should never be internet-facing. Restrict TCP 9191/9192 to required internal segments at the firewall, place administrative access behind VPN/ZTNA, and enforce strong authentication on the admin console. Verify bindings with the audit script above — 0.0.0.0 listeners on print servers are a finding on their own.

4. Reduce the service's blast radius. Run the application server under a least-privilege service account rather than SYSTEM or a domain account where operationally feasible, apply application control (WDAC/AppLocker) to constrain child processes of the PaperCut Java runtime on the server, and ensure EDR coverage with tamper protection on every print server.

5. Integrate into vulnerability management SLAs. Add the two PaperCut flaws to your VM platform as actively-exploited items with an emergency SLA (24-72 hours), not your standard cadence. Monitor the PaperCut security bulletin and the CISA KEV catalog for CVE assignment — once a KEV entry lands, your remediation clock and reporting obligations change.

6. Verify backups and segmentation. Print servers sit adjacent to user workstations and file infrastructure. Confirm that PaperCut hosts are segmented from high-value assets and that your recovery plan accounts for a print-server-origin ransomware event.

Bottom Line

Two PaperCut NG/MF flaws are being actively exploited, and the vendor has consolidated its response into maintenance releases 26.0.5, 25.0.13, and 24.1.10. Patch now, hunt for compromise on anything that was exposed, and treat your print infrastructure as the tier-one attack surface it demonstrably is. The window between patch release and mass exploitation is short — and for PaperCut, history says the ransomware crews are already inside it.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub