Urgent PaperCut NG/MF Vulnerability: What You Need to Know

If you run PaperCut NG or PaperCut MF, this is the one advisory to stop and read today.

In short: PaperCut has confirmed active, real-world exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. Every supported version of both products was potentially exposed. PaperCut has now released an official Security Maintenance Release (NG/MF 26.0.5, 25.0.13, and 24.1.10) that replaces all three emergency patches and is the recommended build for every customer, whether or not you've already patched. Full details are in PaperCut's official bulletin, Urgent Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026), and we'll keep this post updated as new information comes in.

Publish and update history

Published at 9:10 AM CT on August 28, 2026.

Updated at 7:10 AM CT on September 1, 2026, to add known post-patch issues with Card/ID lookups and SAML and Emergency Patch (Release 3).

Updated at 1:10 PM CT on September 10, 2026, to reflect PaperCut's official Security Maintenance Release (26.0.5, 25.0.13, 24.1.10), which replaces all emergency patches.

What's happening, at a glance

Here's what PaperCut has confirmed so far:

Its security team is investigating active exploitation of a vulnerability in PaperCut NG and PaperCut MF, and has confirmed multiple customer incidents.
All versions of NG and MF are listed as potentially impacted, so your specific version number alone doesn't tell you whether you're exposed.
PaperCut issued three emergency patches between August 28 and September 1, each adding hardening on top of the last.
On September 10, PaperCut replaced all three with an official Security Maintenance Release: NG/MF 26.0.5, 25.0.13, and 24.1.10. It's been through full QA and is now the recommended build for every customer, patched or not.
Two CVEs have been published. CVE-2026-82078 (9.4, Critical) — unsafe dynamic class loading in the database connector, allowing arbitrary code execution. CVE-2026-81578 (8.8, High) — an authentication bypass in the web management interface.
PaperCut is updating its bulletin as the investigation continues, so treat this as a developing situation.

First: check whether your PaperCut server is exposed to the internet

Before anything else, find out whether your PaperCut NG/MF Application Server can be reached from the public internet. If it can, restrict access immediately.

Use firewall rules, network access controls, or an equivalent measure so the server's web interfaces are reachable only from trusted IP addresses, such as your internal network. PaperCut recommends this step even if you haven't seen anything suspicious yet.

It's the single most effective thing you can do while the investigation continues.

PaperCut has released an official maintenance release

PaperCut's Security Maintenance Release — NG/MF 26.0.5, 25.0.13, and 24.1.10 — is available now for Windows, Linux, and macOS. It's the build PaperCut recommends for every customer going forward.

Already installed Emergency Patch Release 3? You're protected against the vulnerabilities in this advisory and can move to the maintenance release on your normal upgrade schedule. Still on Release 1 or 2, or haven't patched at all? PaperCut recommends upgrading now.

The release is specifically intended for customers with public-facing PaperCut servers who are unable to mitigate the issue another way. This is a rarely used feature, but if you use Card/ID number lookups from an external database, you'll need to add a configuration key (security.card-number-lookup.enabled=Y) to server/security.properties and restart the Application Server after installing — otherwise PaperCut will silently ignore those lookup calls. Review PaperCut's FAQ for the full steps before you install.

A few configuration notes carry over from the emergency patches. If you use Card/ID number lookups from an external database — a rarely used feature — you'll still need the security.card-number-lookup.enabled=Y key in server/security.properties. If you're on the legacy Sourceforge jTDS driver for SQL Server lookups, move to the current Microsoft SQL JDBC driver. Site Servers and secondary print servers need the update too, not just your main Application Server. Print Deploy, Mobility Print, and Marco's client software aren't affected.

Running PaperCut NG/MF version 23 or earlier? There's no patch or maintenance release for your version. Upgrading to a supported line (24, 25, or 26) is the only way to a patched build — until then, restricting access to your Application Server is essential.

If you're running an older PaperCut version, don't assume you're in the clear. PaperCut currently lists all versions of NG and MF as potentially impacted.

Indicators of compromise

PaperCut has shared a few early indicators of compromise. In your server.log, watch for:

Alerts from your intrusion-detection, endpoint-security, or network-monitoring tools referencing the PaperCut Application Server, particularly unusual activity from pc-app.exe
Missing, unexpectedly truncated, or deleted PaperCut server.log files.
Any of the following entries in server.log:
- ERROR No suitable driver found for jdbc:no:x
- ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

Not seeing any of these signs isn't confirmation that you're in the clear. PaperCut's investigation is ongoing, and it expects to publish more specific, validated indicators as they're confirmed.

The bottom line

This is an active security issue, not a theoretical one.

If you use PaperCut NG or MF:

Find out whether your Application Server is exposed to the internet.
Restrict public access immediately if it is.
Review PaperCut's Security Maintenance Release: NG/MF 26.0.5, 25.0.13, and 24.1.10 and apply it where appropriate.
Check your logs and security tools for suspicious activity.
Keep watching PaperCut's advisory as new information is released.

Marco is continuing to monitor the situation. If you're a Marco client and need help reviewing your PaperCut environment or determining your next step, contact Marco. We also recommend that our clients sign up to subscribe to PaperCut security notifications, so they are alerted immediately to any future updates/vulnerabilities.