PaperCut NG/MF Zero-Day Under Active Exploitation: Emergency Patch, Detection, and Hardening Guide

PaperCut Software has issued an emergency advisory warning that attackers are actively exploiting a previously unpatched vulnerability in its NG and MF print management products. The company has released out-of-band patches but, critically, has not yet assigned a CVE identifier or published technical details — a strong indicator that the vendor is trying to get fixes deployed before a broader exploitation wave follows the inevitable reverse-engineering of the patch.

This pattern should be painfully familiar to defenders. PaperCut NG/MF has been a favored initial-access target for years precisely because print management servers sit in a uniquely privileged position: they are network-accessible by design, they hold or broker credentials (LDAP/AD integration, domain service accounts), they often run with elevated privileges, and they historically receive far less patching attention than domain controllers or VPN appliances. When a vendor says "actively exploited, no technical details, patch now," the correct response is to treat it as a full zero-day incident — not a routine patch cycle item.

If you run PaperCut NG or MF anywhere in your estate — including hosted or cloud-deployed instances — assume exposure until proven otherwise.

Technical Analysis

Affected Products

PaperCut NG — the self-hosted print management platform deployed widely across education, healthcare, legal, and enterprise environments.
PaperCut MF — the multifunction-device variant with embedded software on copiers/MFPs, typically integrated with Active Directory/LDAP for authentication and accounting.

PaperCut MF and NG share the same core application server codebase (the pc-app service / pc-app.exe process), which is why a single flaw typically affects both product lines simultaneously.

Vulnerability Details (What We Know and Don't Know)

As of publication:

No CVE has been assigned. Do not wait for a CVE record, CVSS score, or NVD entry to act. Vendor-acknowledged active exploitation outranks any scoring system.
Technical details are withheld. This is deliberate — PaperCut is attempting to maximize the patch-deployment window before threat actors diff the patched binaries and develop mass-exploitation tooling. Expect public technical write-ups and exploit code within days to weeks of patch release. That is your real deadline.
Exploitation is confirmed in the wild. This is not theoretical. The vendor's own advisory confirms ongoing attacks.

Why PaperCut Is a High-Value Target

From a defender's threat-modeling perspective, the PaperCut application server is attractive because:

Remote code execution paths are plentiful. Historically, PaperCut flaws have enabled unauthenticated or low-authentication RCE by abusing the print scripting engine, template evaluation, or administrative setup functions.
It runs with SYSTEM/root privileges. The application server service typically executes as a highly privileged account, and is frequently installed with domain-integrated service credentials.
It is a credential and pivot goldmine. PaperCut servers commonly store LDAP bind credentials, hold print-job metadata containing user identities, and provide a launchpad for lateral movement into AD environments.
Post-exploitation is noisy in predictable ways. Exploitation of a Java-based application server almost universally manifests as the application process spawning unexpected child processes (cmd.exe, powershell.exe, /bin/sh, /bin/bash) to deploy webshells, download second-stage payloads, or execute discovery commands.

Exploitation Status

In-the-wild exploitation: CONFIRMED (per vendor advisory).
Public PoC: Not yet released — but assume it is coming once the patch is analyzed.
CISA KEV: Monitor closely. Given the active exploitation and the product's ubiquity in education and government, KEV inclusion is a realistic near-term outcome. If added, federal agencies and aligned organizations will face a binding remediation deadline.

Detection & Response

Because the vendor has withheld specifics, detection engineering must focus on behavioral indicators of post-exploitation rather than exploit signatures. The highest-fidelity signal for compromise of a PaperCut application server is the server process spawning command interpreters or script engines — legitimate PaperCut operation rarely, if ever, does this.

Sigma Rules

YAML

---
title: PaperCut Application Server Spawning Command Interpreter
id: 9c2e7a41-3f68-4b1d-ae52-8d4c6f1a9b03
status: experimental
description: Detects the PaperCut application server process (pc-app.exe) spawning command shells or script engines, a strong post-exploitation indicator following compromise of PaperCut NG/MF application vulnerabilities.
references:
  - https://securityaffairs.com/197980/hacking/papercut-zero-day-under-active-attack-emergency-patch-released.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pc-app.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare custom print scripting integrations that invoke system commands — validate against your environment's PaperCut script config
level: critical
---
title: Webshell Dropped in PaperCut Installation Directory
id: 4d8b3f92-1a75-4e6c-bf39-7c2d5e8a4f16
status: experimental
description: Detects creation of script files (JSP, PHP, ASPX) or executables in PaperCut NG/MF web and installation directories, consistent with webshell deployment after application exploitation.
references:
  - https://securityaffairs.com/197980/hacking/papercut-zero-day-under-active-attack-emergency-patch-released.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\PaperCut NG\'
      - '\PaperCut MF\'
      - '\papercut\server\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.php'
      - '.aspx'
      - '.ashx'
      - '.exe'
      - '.dll'
      - '.bat'
      - '.ps1'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate PaperCut upgrades or custom report/template deployment — correlate with change windows
level: high
---
title: PaperCut Server Process Outbound Connection to Uncommon Destination
id: 6f1a9d54-8c32-4e7b-a914-2b5e3c7d8f29
status: experimental
description: Detects the PaperCut application server process initiating outbound network connections, which may indicate post-exploitation C2 traffic or payload retrieval from a compromised NG/MF server.
references:
  - https://securityaffairs.com/197980/hacking/papercut-zero-day-under-active-attack-emergency-patch-released.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\pc-app.exe'
      - '\pc-app-monitor.exe'
    Initiated: 'true'
  filter_known_good:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_known_good
falsepositives:
  - PaperCut cloud licensing/telemetry and PaperCut Pocket/Hive integrations — baseline legitimate destinations before enabling at high sensitivity
level: medium

KQL Hunt (Microsoft Sentinel / Defender)

This query hunts for the PaperCut application process spawning interpreters or LOLBins, plus suspicious file drops in PaperCut directories. Run it across a lookback window of at least 14 days — zero-day exploitation frequently predates disclosure.

KQL — Microsoft Sentinel / Defender

// Hunt: PaperCut NG/MF post-exploitation behaviors (process spawning + file drops)
let lookback = 14d;
let interpreters = dynamic(["cmd.exe","powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","curl.exe","wget.exe","whoami.exe","net.exe","nltest.exe","ipconfig.exe"]);
let papercut_procs = dynamic(["pc-app.exe","pc-app-monitor.exe"]);
union
(
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessFileName in~ (papercut_procs)
    | where FileName in~ (interpreters)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
              FileName, ProcessCommandLine, AccountName, ReportId
),
(
    DeviceFileEvents
    | where Timestamp > ago(lookback)
    | where FolderPath has_any ("PaperCut NG", "PaperCut MF", @"papercut\server")
    | where FileName endswith_any (".jsp", ".jspx", ".php", ".aspx", ".exe", ".bat", ".ps1", ".dll")
    | where ActionType in ("FileCreated", "FileModified")
    | project Timestamp, DeviceName, ActionType, FolderPath, FileName,
              InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId
),
(
    // Syslog/CEF path for Linux-hosted PaperCut application servers
    Syslog
    | where TimeGenerated > ago(lookback)
    | where SyslogMessage has_any ("pc-app", "papercut") and SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl", "wget")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage
)
| order by Timestamp desc

Velociraptor VQL Hunt

Use this artifact across your PaperCut server fleet to surface anomalous child processes of the application service and recently created script files in installation paths — the two artifacts most likely to survive a hasty cleanup.

VQL — Velociraptor

-- Hunt: PaperCut NG/MF compromise indicators
-- Looks for pc-app spawning interpreters and recent script/executable drops in install dirs

-- Part 1: Suspicious processes spawned by or related to PaperCut services
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)pc-app'
   OR CommandLine =~ '(?i)(cmd\.exe|powershell|pwsh|mshta|certutil|bitsadmin|/bin/sh|/bin/bash)'

-- Part 2: Recently created script/executable files in PaperCut installation paths
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Program Files/PaperCut NG/**/*.jsp',
  'C:/Program Files/PaperCut MF/**/*.jsp',
  'C:/Program Files/PaperCut NG/**/*.php',
  'C:/Program Files/PaperCut MF/**/*.php',
  'C:/Program Files/PaperCut NG/server/**/*.exe',
  'C:/Program Files/PaperCut MF/server/**/*.exe',
  '/opt/papercut/server/**/*.jsp'
])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

-- Part 3: Active network connections from PaperCut processes
SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Name =~ '(?i)pc-app' AND Status =~ 'ESTAB'

Verification and Triage Script

Run this PowerShell on Windows-hosted PaperCut application servers to confirm installed version, review recent process ancestry evidence, and enumerate recently modified files in the installation path. Feed output to your IR team before and after patching.

PowerShell

# PaperCut NG/MF - Version verification and compromise triage
# Run elevated on the PaperCut Application Server

# 1. Identify installed PaperCut version from the install path
$paths = @("C:\Program Files\PaperCut NG", "C:\Program Files\PaperCut MF")
foreach ($p in $paths) {
    if (Test-Path $p) {
        Write-Host "[+] Found installation: $p"
        $versionFile = Get-Content "$p\server\version.txt" -ErrorAction SilentlyContinue
        Write-Host "[+] Installed version: $versionFile"
        Write-Host "[!] Compare against the fixed build in the PaperCut security advisory."
    }
}

# 2. Check the PaperCut service state and binary
Get-Service | Where-Object { $_.Name -match 'PCApp|Papercut' } |
    Select-Object Name, Status, StartType | Format-Table -AutoSize
Get-Process pc-app* -ErrorAction SilentlyContinue |
    Select-Object Name, Id, Path, StartTime | Format-List

# 3. Hunt for suspicious child processes spawned by pc-app in recent event logs
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14)} `
    -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'pc-app.exe' -and
                   $_.Message -match 'cmd.exe|powershell.exe|mshta.exe|certutil.exe|bitsadmin.exe' } |
    Select-Object TimeCreated, Message -First 25

# 4. Enumerate recently created/modified script and executable files in install dirs
foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include *.jsp,*.jspx,*.php,*.aspx,*.exe,*.bat,*.ps1 `
            -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
            Select-Object FullName, LastWriteTime, CreationTime, Length |
            Sort-Object LastWriteTime -Descending
    }
}

# 5. Confirm remote management exposure - admin interface should NOT be internet-facing
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -in 9191,9192,9193 } |
    Select-Object LocalAddress, LocalPort, OwningProcess | Format-Table -AutoSize

Remediation

1. Patch Immediately — Treat as Zero-Day

Apply the emergency patches released by PaperCut for NG and MF without waiting for the standard change window. Active exploitation supersedes normal patch cadence.
Obtain the fixed builds and official guidance directly from the PaperCut security advisory page (https://www.papercut.com/kb/Main/Security / PaperCut's published security bulletins) and the vendor advisory referenced in reporting: https://securityaffairs.com/197980/hacking/papercut-zero-day-under-active-attack-emergency-patch-released.html
Verify version after patching — do not trust the installer exit code. Confirm via the admin console About page and the version.txt artifact on disk, and record the build hash in your asset inventory.
Do not forget secondary components: PaperCut MF Site Servers, secondary print servers, and embedded MFP clients all need review, though the application server is the primary attack surface.

2. If You Cannot Patch Today — Compensating Controls

Block all inbound internet access to PaperCut interfaces (default ports 9191/9192/9193) at the perimeter. There is no legitimate reason for a print management admin or user portal to be internet-exposed. This single control breaks the most common exploitation path for this product class.
Restrict network reachability to the application server to only required subnets (user VLANs for the portal, admin workstations for management).
Disable remote admin access from untrusted networks and enforce MFA where supported for administrative logon.
If the server must remain exposed and unpatched, seriously consider taking the service offline until patched. An unavailable print accounting portal is cheaper than a domain compromise.

3. Hunt Before You Trust

Patching closes the door; it does not evict anyone already inside. Before declaring remediation complete:

Run the detection content above across at least a 14-day lookback (longer if telemetry retention allows — dwell time before disclosure is unknown).
Examine PaperCut's own logs (server/logs within the install directory, and the admin access log) for anomalous admin logons, failed authentication bursts, or unexpected configuration changes.
Review LDAP bind and service account activity for the PaperCut service account — any authentication from unusual hosts or at unusual hours warrants credential rotation.
Rotate credentials for the PaperCut service account and any stored LDAP/SMTP credentials if any suspicious indicator is found, or as a precaution on internet-exposed servers.

4. Verify Persistence Wasn't Established

Check for new local/domain accounts, unexpected scheduled tasks, new services, and run-key modifications on the PaperCut host.
If compromise is confirmed or strongly suspected: isolate the host, capture memory and disk images, and engage your IR retainer. Rebuilding the PaperCut server from known-good media is the only fully trustworthy recovery once RCE is confirmed on a system that held domain-integrated credentials.

5. Longer-Term Hardening

Add PaperCut NG/MF to your emergency patch SLA tier alongside VPNs, firewalls, and remote access products — internet-reachable application servers get 24–72 hour patch targets, not monthly cycles.
Subscribe to PaperCut's security advisory feed and monitor CISA KEV for this vulnerability once it receives a CVE identifier; KEV listing will impose a formal remediation deadline for federal agencies and should be treated as one by everyone else.
Segment print infrastructure so that a compromised PaperCut host cannot directly reach domain controllers, and alert on any attempt to do so.

Bottom line: Vendor-confirmed active exploitation with withheld technical details means the exploitation-for-all window opens the moment someone diffs the patch. Patch now, hunt back two weeks, rotate integrated credentials on any host showing anomalies, and get PaperCut off the internet permanently.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub