Company
PaperCut Software is an Australian company that makes print management software used by schools, businesses, and government agencies worldwide.
PaperCut flaws tracked under three CVEs chain into code execution before login, according to an analysis published on dev.to. No credentials are needed, so any host that can send the server a print job is within reach of the chain until fixed builds are confirmed.
Reality
PaperCut's 27 August 2026 advisory of in-the-wild exploitation hid a pre-auth RCE chain whose first patch, 26.0.4, watchTowr defeated within a day. Operators who patched once and stopped tracking the CVEs may still be reachable without credentials.
Reality
Arctic Wolf reports the two newly disclosed PaperCut bugs being used together against K-12 and university print servers in the US and Europe, with collection aimed at the directory credentials the server stores to do its job.
Perspective Coverage
3 publishersReality
PaperCut NG/MF 26.0.5, 25.0.13 and 24.1.10 carry every fix from three emergency patch rounds plus two regression fixes, while GreyNoise and Blackpoint Cyber count at least 395 organizations already breached.
Reality
PaperCut told NG and MF customers on August 27 that servers were already being exploited, with no CVE and no fix available. A patch that held arrived on September 1, and Picus Security says that gap is now the normal shape of a zero-day.
Reality
PaperCut's founder and CEO says the NG/MF incident is still open. Logs from two customers in the same region let his engineers rebuild most of the exploit chain, and the 2023 aftermath drove the order to unplug.
Reality
Vidar, LummaC2, RedLine and Atomic Stealer are pulling session material that authenticates without a login prompt, so the usual reset-and-enroll response can leave the intruder inside and spending the victim's paid usage.
Reality
PaperCut says the advisory covers all releases of NG and MF, that exploitation is already happening in customer environments, and that its fix is an emergency patch built outside the normal release process.
Reality
PaperCut has shipped a second emergency patch after bypass vectors survived the first one, and the chain being exploited runs from an unauthenticated HTTP request to code execution on the print server.
Reality