Fresh PaperCut Vulnerabilities Exploited to Steal Data

Two vulnerabilities in the PaperCut NG and MF print management software—patched last week after being exploited as zero-days—are now being used in attacks aimed at stealing data. According to the developer, the product is used by around 100 million people across more than 70,000 organizations, including large companies, government agencies and educational institutions.

A Chain of Two Vulnerabilities

The flaws, assigned the identifiers CVE-2026-81578 and CVE-2026-82078, can be chained together to bypass authentication and achieve remote code execution on vulnerable PaperCut servers. The company released two sets of emergency patches on Thursday and Friday and published indicators of compromise to help defenders block the ongoing attacks. That said, the origin of the attacks has not yet been established, and the developer has not explained what exactly the attackers do once they breach the servers.

Betting on Data Theft

Over the weekend, threat analysis firm Defused confirmed that attackers have begun exploiting both vulnerabilities to steal data from victims' servers. According to its observations, honeypot activity has been recorded since the night of August 29 UTC. Unlike the remote code execution scenario described in public materials, the attacker uses the authentication bypass to hijack PaperCut's external user lookup mechanism and dump database tables through the Derby DBMS.

The Shadowserver monitoring service is currently tracking more than 800 internet-exposed PaperCut MF and NG servers, though it is unknown how many of them are honeypots or already patched.

Not the First Year in the Crosshairs

PaperCut vulnerabilities have drawn attention before, from both state-sponsored groups and ransomware operators. In April 2023, a critical remote code execution flaw (CVE-2023-27350) was used together with an information disclosure vulnerability (CVE-2023-27351) in attacks linked to the LockBit and Clop groups. Two weeks later, Microsoft reported that the Iranian state-sponsored groups Muddywater and APT35 had joined the attacks, abusing the print archiving feature. In May of that year, the FBI and CISA warned about the exploitation of CVE-2023-27350 by the Bl00dy group for initial access to victims' networks, and in July 2025 CISA flagged the active exploitation of yet another vulnerability—CVE-2023-2533.

Source: Bleeping Computer