Back to Intelligence

PaperCut NG/MF Zero-Day Under Active Exploitation: Emergency Patching and Detection Guide

SA
Security Arsenal Team
August 29, 2026
9 min read

PaperCut Software has confirmed that attackers are actively exploiting an unpatched vulnerability affecting its NG and MF print management products. The company has released emergency patches, but — critically — no CVE has been assigned yet and no technical details have been published. That combination should set off alarms for every defender: when a vendor rushes out an emergency fix while withholding details, it usually means exploitation is real, ongoing, and the vendor is trying to give customers a patching head start before threat actors reverse-engineer the fix.

Print management servers are high-value targets. They sit inside the network perimeter, typically run with elevated privileges, hold credentials for directory integration (LDAP/Active Directory), and are reachable by nearly every workstation in the enterprise. PaperCut's NG and MF products are deployed across education, healthcare, legal, and corporate environments worldwide — and history has shown that when PaperCut vulnerabilities go public, ransomware operators and initial access brokers move within days.

If you run PaperCut NG or MF anywhere in your environment, treat this as an incident in progress, not a routine patch cycle.

Technical Analysis

Affected Products

  • PaperCut NG — self-hosted print management application
  • PaperCut MF — the enterprise/MFD-integrated variant built on the same application server core

Both products share the same application server codebase (pc-app on Windows, the papercut service on Linux/macOS), which is why a single flaw impacts both lines. The application server exposes a web interface on TCP 9191 (HTTP) and 9192 (HTTPS) by default, with administrative and user portals.

Vulnerability Details

At the time of writing:

  • CVE: None assigned yet
  • CVSS: Not published
  • Technical details: Withheld by the vendor
  • Exploitation status: Confirmed active in-the-wild exploitation, per PaperCut's own warning

Because exploitation precedes public detail, defenders must reason from the architecture. Historically, critical PaperCut flaws have involved the web application layer — authentication bypass or improper access control in the admin interface, leading to remote code execution in the security context of the PaperCut service account (often SYSTEM on Windows). Until PaperCut publishes specifics, the prudent assumption is pre-authentication remote code execution via the web interface, because that is the class of bug that justifies an emergency patch under embargo.

Why This Attack Surface Matters

A compromised PaperCut server gives an attacker:

  • A foothold as SYSTEM or a service account on an internal server
  • Harvestable credentials — PaperCut commonly integrates with Active Directory/LDAP and stores sync credentials
  • A lateral movement launchpad — print servers are typically reachable from every user VLAN
  • Persistence opportunities — the PaperCut application server can execute scripts and hooks (e.g., print script hooks), which have been abused in prior campaigns for code execution

Detection & Response

With no published IOCs, behavioral detection is your primary weapon. The highest-fidelity signal for PaperCut exploitation is the application server process spawning unexpected child processes — shells, scripting engines, or reconnaissance tooling. On Windows that means pc-app.exe (or the Java process backing it) spawning cmd.exe, powershell.exe, whoami.exe, net.exe, or similar. Legitimate PaperCut deployments almost never do this outside of deliberate print-script configurations.

SIGMA Rules

YAML
---
title: PaperCut Application Server Spawning Shell or Recon Tools
id: 8f2c4e71-3b9a-4d55-a1c7-6e9f2b8d4a01
status: experimental
description: Detects the PaperCut application server process spawning command shells, scripting engines, or reconnaissance binaries — a strong indicator of post-exploitation activity following compromise of the PaperCut NG/MF web interface.
references:
  - https://securityaffairs.com/197980/uncategorized/papercut-zero-day-under-active-attack-emergency-patch-released.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.execution
  - attack.t1059
  - attack.discovery
  - attack.t1033
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pc-app.exe'
      - '\pc-server.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
      - '\ipconfig.exe'
      - '\systeminfo.exe'
      - '\quser.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Deliberately configured PaperCut print script hooks executing batch/PowerShell scripts — validate against documented print script configuration before dismissing
level: high
---
title: PaperCut Service Spawning Suspicious Processes on Linux
id: 1d7a9c34-5e28-4f61-b3d9-2c4e6a8f0b72
status: experimental
description: Detects the PaperCut application server on Linux spawning interactive shells, download utilities, or reconnaissance commands, consistent with post-exploitation of the PaperCut NG/MF web application.
references:
  - https://securityaffairs.com/197980/uncategorized/papercut-zero-day-under-active-attack-emergency-patch-released.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.execution
  - attack.t1059.004
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'papercut'
      - 'pc-app'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
      - '/whoami'
      - '/id'
  condition: selection_parent and selection_child
falsepositives:
  - PaperCut server commands and custom print scripts configured by administrators
level: high

KQL (Microsoft Sentinel / Defender)

This query hunts for the PaperCut application server spawning suspicious child processes across your Windows estate, and can be extended to Syslog-ingested Linux events. Run it over at least the last 30 days — if exploitation has been active before patch availability, you need historical coverage, not just forward-looking alerting.

KQL — Microsoft Sentinel / Defender
// Hunt: PaperCut application server spawning suspicious child processes
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","wscript.exe","cscript.exe","whoami.exe","net.exe","net1.exe","nltest.exe","ipconfig.exe","systeminfo.exe","curl.exe","certutil.exe","bitsadmin.exe","wmic.exe","regsvr32.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("pc-app.exe", "pc-server.exe")
   or InitiatingProcessCommandLine has_any ("pc-app", "papercut")
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;

// Companion hunt: inbound connections to PaperCut web admin ports from unexpected sources
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where LocalPort in (9191, 9192)
| where InitiatingProcessFileName in~ ("pc-app.exe", "java.exe", "pc-server.exe")
| summarize ConnectionCount = count(),
            SourceIPs = make_set(RemoteIP, 25),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
   by DeviceName, LocalPort, RemotePort
| order by ConnectionCount desc;

Velociraptor VQL

Use this hunt artifact across PaperCut servers to identify suspicious child process execution — a rapid way to sweep for post-exploitation behavior before and after patching:

VQL — Velociraptor
-- Hunt for suspicious child processes spawned by the PaperCut application server
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       get_member(field='Exe') as BinaryPath
FROM pslist()
WHERE CommandLine =~ '(?i)(cmd\.exe|powershell|pwsh|mshta|rundll32|whoami|net\.exe|curl|certutil|bitsadmin|/bin/(ba)?sh|wget|nc |python)'
  AND Ppid IN (
       SELECT Pid
       FROM pslist()
       WHERE Name =~ '(?i)(pc-app|pc-server|papercut)'
          OR Exe =~ '(?i)(papercut|pc-app|pc-server)'
  )

Verify Patch Status and Baseline Your Servers

Run this on every Windows PaperCut application server to confirm the installed version, enumerate recent child processes of the PaperCut service, and check for recently modified files in the PaperCut installation directory (a common drop location for web shells and attacker tooling):

PowerShell
# 1. Confirm PaperCut is installed and capture the running version
$service = Get-Service -Name 'PCAppSvc','PaperCut*' -ErrorAction SilentlyContinue
$service | Format-Table Name, Status, StartType -AutoSize

# 2. Pull the product version from the install directory
$pcPath = 'C:\Program Files\PaperCut MF'
if (-not (Test-Path $pcPath)) { $pcPath = 'C:\Program Files\PaperCut NG' }
if (Test-Path "$pcPath\server\version.txt") {
    Get-Content "$pcPath\server\version.txt"
} else {
    Get-ChildItem "$pcPath\server" -Filter '*.jar' -ErrorAction SilentlyContinue |
        Select-Object -First 5 Name
}

# 3. Enumerate current children of the PaperCut process
$pcProcs = Get-CimInstance Win32_Process | Where-Object { $_.Name -match 'pc-app|pc-server' }
foreach ($p in $pcProcs) {
    Get-CimInstance Win32_Process |
        Where-Object { $_.ParentProcessId -eq $p.ProcessId } |
        Select-Object ProcessId, Name, CommandLine, CreationDate
}

# 4. Flag files modified in the last 14 days under the PaperCut web/server directories
Get-ChildItem "$pcPath\server" -Recurse -Include *.jsp,*.war,*.exe,*.dll,*.ps1,*.bat,*.jspx -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object FullName, LastWriteTime, Length |
    Sort-Object LastWriteTime -Descending

# 5. Check who can reach the admin interface — it should NOT be exposed to user VLANs or the internet
Get-NetTCPConnection -LocalPort 9191,9192 -State Listen -ErrorAction SilentlyContinue |
    Select-Object LocalAddress, LocalPort, State

Remediation

  1. Patch immediately. Apply the emergency update from PaperCut for both NG and MF across all application servers, site servers, and secondary servers. Pull the patched release directly from PaperCut's official release notes and upgrade paths at https://www.papercut.com/kb/Main/SecurityBulletins and the vendor's security advisory page. Do not wait for your normal patch window — this is confirmed active exploitation.
  2. Verify the patch applied. Confirm the build number post-upgrade and validate the application server restarted cleanly. A failed or partial upgrade leaves you exposed while creating false confidence.
  3. Restrict network access to the admin interface now. Even after patching, ports 9191/9192 (especially /admin) should be reachable only from a dedicated management subnet or jump host. Block access from user VLANs and ensure the interface is never exposed to the internet — check NAT rules, cloud security groups, and any reverse proxies fronting the server.
  4. Hunt before you assume you're clean. Because exploitation predates the patch, run the detections above across at least 30 days of telemetry. Look for child processes of the PaperCut server, unexpected outbound connections from the print server, new local accounts, and recently written files under the PaperCut installation.
  5. Rotate credentials if compromise is suspected. PaperCut commonly stores AD/LDAP sync credentials. If you find evidence of execution from the PaperCut process, treat those credentials as compromised — rotate service accounts and review directory access from the server.
  6. Review print script configuration. Audit PaperCut's server/print script hooks for unauthorized entries — these are a documented persistence and execution mechanism on compromised servers.
  7. Monitor for follow-on detail publication. When PaperCut assigns a CVE and publishes technical details, expect rapid PoC development and a second wave of exploitation against unpatched stragglers. Subscribe to the vendor advisory feed and watch for a CISA KEV listing, which would impose federal remediation deadlines and signal broad weaponization.
  8. Segment print infrastructure permanently. Print servers should live in a restricted server tier with egress filtering — they need to talk to printers, clients on defined ports, and directory services, not the open internet. Deny-by-default outbound rules would have blunted the post-exploitation phase of this campaign.

The Bottom Line

Vendor silence on technical details is not a reason to wait — it's a reason to move faster. Active exploitation plus an emergency patch means the window between "patched" and "breached" is measured in days. Patch your PaperCut NG and MF servers now, lock down the admin interface, and hunt for compromise assuming the attack window opened before you got the patch. If your print server shows the PaperCut process spawning shells, you're no longer patching — you're in incident response.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

criticalzero-daycvepatch-tuesdayexploitvulnerability-disclosurepapercutpapercut-ng-mfactive-exploitationprint-management

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action