Back to Intelligence

PaperCut NG/MF Flaw Exploited in the Wild: Detection and Remediation Guide for Print Management Servers

SA
Security Arsenal Team
August 28, 2026
11 min read

PaperCut has issued an urgent advisory confirming that threat actors are actively exploiting a vulnerability affecting all versions of PaperCut NG and PaperCut MF print management software. This is not a theoretical disclosure — exploitation is happening in the wild against unpatched servers right now.

Print management servers sit in a uniquely dangerous position in most enterprise environments. They are network-reachable by design, they typically hold domain credentials or service accounts for LDAP/Active Directory integration, they run with elevated privileges on the host, and — critically — they are almost never covered by EDR, monitored by the SOC, or included in routine patch cadences. In my IR casework, print and document infrastructure is one of the most consistently blind spots I encounter during post-compromise scoping. Attackers know this.

If you run PaperCut NG or MF anywhere in your environment — on-premises, in a data center, or in a cloud VPC — treat this as an emergency patch event. If your PaperCut application server is reachable from the internet (and more are than you'd expect), assume compromise until you have evidence otherwise and hunt accordingly.

Technical Analysis

Affected Products

  • PaperCut NG — all versions prior to the vendor's patched releases
  • PaperCut MF — all versions prior to the vendor's patched releases
  • Platforms: Windows and Linux application servers (the PaperCut application server component is the exposed attack surface)

PaperCut's install base spans education, healthcare, legal, government, and managed print providers — sectors where print infrastructure is mission-critical and downtime is heavily resisted. That resistance is exactly what attackers are counting on.

How the Attack Works (Defender's View)

Based on the observable behavior in this campaign, the attack chain follows a pattern consistent with remote code execution against the PaperCut application server:

  1. Initial access — The attacker sends crafted requests to the PaperCut application server, which listens by default on TCP 9191 (HTTP) and 9192 (HTTPS). Internet-exposed instances are being scanned for and hit en masse; internal instances are reached after initial foothold elsewhere.
  2. Code execution in the service context — Successful exploitation executes code in the context of the PaperCut service. On Windows this is the pc-app.exe process (a Java-based service typically running as SYSTEM or a service account); on Linux it is the Java process running under the papercut user.
  3. Post-exploitation — The defining forensic indicator of this campaign is the PaperCut application server process spawning child processes it never spawns in normal operation: cmd.exe, powershell.exe, wscript.exe, rundll32.exe, or on Linux /bin/sh and /bin/bash. From there, operators stage tooling, dump credentials, and pivot.
  4. Persistence and lateral movement — Because print servers are trusted by endpoints and hold directory credentials, they serve as an ideal pivot point. Expect creation of local accounts, webshell-like artifacts dropped under the PaperCut installation directory, and outbound connections to attacker infrastructure.

The exploitation requirements are low: network reachability to the application server ports is sufficient, and the attack does not require valid credentials against a vulnerable instance.

Exploitation Status

  • Confirmed active exploitation in the wild — this is the core of PaperCut's warning.
  • The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, which carries a mandatory remediation deadline for U.S. federal civilian agencies and should be treated as a de facto deadline for everyone else.
  • Internet-wide scanning for exposed PaperCut instances spiked following disclosure. Any instance on a public IP should be considered targeted.

Detection & Response

This is an actively exploited technical threat. The detections below target the highest-fidelity observable from this campaign: the PaperCut server process spawning command interpreters or script engines. This behavior has essentially no legitimate baseline — PaperCut does not shell out to cmd, PowerShell, or bash during normal print operations. That makes it the rare detection that is both high-signal and low-noise.

Sigma Rules

YAML
---
title: PaperCut Application Server Spawning Shell or Script Interpreter
id: 3f8c2a91-7b4d-4e6a-9c15-2d8f1a5b9e07
status: experimental
description: Detects the PaperCut NG/MF application server process (pc-app.exe) spawning command shells or scripting engines, a key indicator of active exploitation of the PaperCut vulnerability described in the vendor's zero-day advisory.
references:
  - https://www.bleepingcomputer.com/news/security/papercut-warns-of-ng-mf-flaw-exploited-in-zero-day-attacks/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\pc-app.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; PaperCut does not spawn command interpreters during normal operation. Investigate all hits.
level: critical
---
title: PaperCut Linux Service Spawning Shell
id: 6b1d4e72-9a3f-4c58-b207-8e4f6d1c3a95
status: experimental
description: Detects the PaperCut application server Java process on Linux spawning shells or download utilities, consistent with post-exploitation of the actively exploited PaperCut NG/MF vulnerability.
references:
  - https://www.bleepingcomputer.com/news/security/papercut-warns-of-ng-mf-flaw-exploited-in-zero-day-attacks/
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'papercut'
      - 'pc-app'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - PaperCut server health-check scripts in rare custom deployments. Validate against documented admin automation.
level: critical
---
title: Inbound Connection to PaperCut Web Management Ports from External Source
id: 9c4e7b15-2d6a-4f83-a518-7b2c9e4d6f31
status: experimental
description: Detects network connections to PaperCut default application server ports (9191/9192) from non-internal sources, which may indicate scanning or exploitation attempts against internet-exposed or segmented print infrastructure.
references:
  - https://www.bleepingcomputer.com/news/security/papercut-warns-of-ng-mf-flaw-exploited-in-zero-day-attacks/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1046
logsource:
  category: firewall
  product: windows
detection:
  selection:
    DestinationPort:
      - 9191
      - 9192
    Initiated: 'true'
  filter_internal:
    SourceIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate remote administration if PaperCut is intentionally exposed (it should not be). Investigate all hits.
level: high

KQL (Microsoft Sentinel / Defender)

This hunt covers both the endpoint telemetry angle (Defender process events on the PaperCut host) and the syslog angle for Linux-hosted instances ingested into Sentinel. Run it across at least 30 days — exploitation may predate the public advisory.

KQL — Microsoft Sentinel / Defender
// Hunt: PaperCut application server spawning suspicious child processes (post-exploitation behavior)
let Lookback = 30d;
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "bitsadmin.exe", "certutil.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe", "ipconfig.exe"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName =~ "pc-app.exe"
       or InitiatingProcessCommandLine has_any ("papercut", "pc-app")
    | where FileName in~ (SuspiciousChildren)
       or (FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python", "python3", "perl"))
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ReportId),
    (Syslog
    | where TimeGenerated > ago(Lookback)
    | where SyslogMessage has "papercut"
       and SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl", "wget", "nc ", "python", "perl")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel)
| order by Timestamp desc

A second query worth running: enumerate internet exposure. Pull your PaperCut hosts from your asset inventory or via DeviceNetworkEvents listening on 9191/9192, then correlate against inbound flows in CommonSecurityLog (firewall/CEF) with public source IPs. If you find any, escalate to incident response immediately rather than treating it as a routine patch ticket.

Velociraptor VQL

Use this artifact to sweep your fleet for live evidence of compromise on PaperCut hosts — specifically, any shell or script interpreter whose parent is the PaperCut service process.

VQL — Velociraptor
-- Hunt: Child processes of the PaperCut application server across the fleet
-- PaperCut (pc-app.exe on Windows, java under papercut home on Linux) should
-- never parent shells, script engines, or download utilities.
LET parents = SELECT Pid, Name, CommandLine
  FROM pslist()
  WHERE Name =~ '(?i)pc-app'
     OR CommandLine =~ '(?i)papercut'

SELECT Pid,
       Ppid,
       Name AS ChildProcess,
       CommandLine AS ChildCommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM parents)
  AND (Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|sh|bash|dash|curl|wget|nc|ncat|python|perl)'
       OR CommandLine =~ '(?i)(invoke-|iex|downloadstring|base64|-enc|/tmp/|http://|https://)')

Follow up on any hit by collecting the PaperCut server logs (under the PaperCut install directory, e.g., C:\Program Files\PaperCut NG|MF\server\logs or /home/papercut/server/logs) and the application server's access logs. Look for unauthenticated requests to administrative and setup endpoints, admin logins from unrecognized IPs, and configuration changes to print scripts or the server command settings — a known post-exploitation persistence lever in PaperCut environments is abuse of its legitimate ability to execute server-side scripts and commands.

Remediation & Verification Script

Run this on Windows-hosted PaperCut application servers to verify installed version, audit for indicators of exploitation, and restrict management-plane exposure. It is read-only except for the optional firewall lockdown at the bottom — review before enforcing.

PowerShell
# PaperCut NG/MF Exploitation Response - Verification & Hardening Script
# Run elevated on the PaperCut application server.

# --- 1. Identify installed PaperCut version ---
$pcPaths = @(
    "$env:ProgramFiles\PaperCut NG",
    "$env:ProgramFiles\PaperCut MF",
    "${env:ProgramFiles(x86)}\PaperCut NG",
    "${env:ProgramFiles(x86)}\PaperCut MF"
)
foreach ($p in $pcPaths) {
    if (Test-Path $p) {
        Write-Host "[+] PaperCut installation found: $p"
        Get-ChildItem $p -Recurse -Filter "*.exe" -ErrorAction SilentlyContinue |
            Select-Object FullName, @{N='Version';E={$_.VersionInfo.ProductVersion}} |
            Format-Table -AutoSize
    }
}
# ACTION: Compare against PaperCut's security advisory. Upgrade to 20.1.7, 21.2.11, 22.0.9 or later,
# per your release branch -- then re-verify the patched build number against the vendor advisory.

# --- 2. Audit for post-exploitation behavior: shells spawned by pc-app.exe ---
$pcProcs = Get-CimInstance Win32_Process -Filter "Name='pc-app.exe'"
foreach $proc in $pcProcs {
    $children = Get-CimInstance Win32_Process -Filter "ParentProcessId=$($proc.ProcessId)"
    foreach ($c in $children) {
        if ($c.Name -match 'cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin') {
            Write-Host "[!] SUSPICIOUS: pc-app.exe (PID $($proc.ProcessId)) spawned $($c.Name) (PID $($c.ProcessId))" -ForegroundColor Red
            Write-Host "    CommandLine: $($c.CommandLine)"
        }
    }
}

# --- 3. Check for recently created local accounts (persistence) ---
Get-LocalUser | Where-Object { $_.PasswordLastSet -gt (Get-Date).AddDays(-60) -or $_.LastLogon -gt (Get-Date).AddDays(-30) } |
    Select-Object Name, Enabled, LastLogon, PasswordLastSet | Format-Table -AutoSize

# --- 4. Check listening exposure of PaperCut ports ---
Get-NetTCPConnection -State Listen -LocalPort 9191,9192 -ErrorAction SilentlyContinue |
    Select-Object LocalAddress, LocalPort, OwningProcess | Format-Table -AutoSize
# If LocalAddress is 0.0.0.0 AND this host has a public interface or NAT mapping, treat as exposed.

# --- 5. (OPTIONAL) Restrict admin interface to management subnet ---
# Adjust -RemoteAddress to your admin/SOC subnet before running.
# New-NetFirewallRule -DisplayName "PaperCut Admin - Mgmt Subnet Only" -Direction Inbound `
#   -LocalPort 9191,9192 -Protocol TCP -RemoteAddress 10.10.5.0/24 -Action Allow
# New-NetFirewallRule -DisplayName "PaperCut Admin - Block All Other" -Direction Inbound `
#   -LocalPort 9191,9192 -Protocol TCP -Action Block

# --- 6. Collect PaperCut server logs for IR review ---
$logDest = "$env:TEMP\papercut-ir-$(Get-Date -Format yyyyMMdd-HHmmss)"
foreach ($p in $pcPaths) {
    $logDir = Join-Path $p "server\logs"
    if (Test-Path $logDir) {
        Copy-Item $logDir -Destination $logDest -Recurse -Force
        Write-Host "[+] Logs staged to $logDest - review access logs for unauthenticated admin/setup requests."
    }
}

For Linux-hosted instances, the equivalent triage: check ps auxf for shells parented to the PaperCut Java process, review /home/papercut/server/logs, audit recent entries in /etc/passwd and authorized_keys files, and confirm the version against the vendor advisory before upgrading.

Remediation

  1. Patch immediately. PaperCut has released fixed builds across supported branches — upgrade to 20.1.7, 21.2.11, or 22.0.9 (or later) depending on your release track. Confirm the exact build against the official PaperCut security advisory linked from their support portal and the BleepingComputer coverage. Do not rely on version strings alone; verify the patched build number post-upgrade.
  2. Verify exposure before you patch. Determine whether your application server ports (9191/9192) are reachable from the internet. Check perimeter firewall/NAT rules, cloud security groups, and run an external scan. If exposed, prioritize that host for full IR scoping — patching a compromised box without investigation only destroys evidence.
  3. Hunt before and after patching. Apply the Sigma, KQL, and VQL detections above across a minimum 30-day lookback. Exploitation of this flaw significantly predates public warning for many victims.
  4. Inspect PaperCut configuration for persistence. Review admin user accounts in the PaperCut console, print scripts, and any server command / script hook settings. Attackers abuse PaperCut's legitimate server-side scripting capability as a durable, EDR-evasive persistence mechanism.
  5. Segment and restrict. Print management interfaces should never be internet-facing. Restrict 9191/9192 to a management subnet, and restrict outbound internet access from the PaperCut host — there is almost no legitimate reason for a print server to initiate arbitrary outbound connections, and egress filtering breaks most post-exploitation tooling.
  6. Rotate credentials if compromise is suspected. PaperCut integrates with AD/LDAP and frequently stores directory bind credentials. Treat any account the service touches as potentially compromised, and rotate local admin and service account passwords on the host.
  7. Meet the CISA KEV deadline. This vulnerability is in the KEV catalog. Federal civilian agencies are bound by the associated remediation date; every other organization should adopt the same date as their internal SLA. If you cannot patch by deadline, isolate the server at the network layer.

Print infrastructure has quietly become one of the highest-yield initial access vectors in enterprise environments — widely deployed, rarely monitored, deeply trusted. Close the gap now, verify you weren't already hit, and fold print servers into your standard EDR and vulnerability management scope permanently.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

criticalzero-daycvepatch-tuesdayexploitvulnerability-disclosurepapercutactive-exploitationprint-serverremote-code-execution

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action