# Print Is Dead. PaperCut Is Not — and Attackers Know It
Print management software doesn't get the threat briefings it deserves. It sits quietly on servers across universities, hospitals, and enterprise campuses, collecting usernames, handling authentication, touching every document that moves through an organization — and getting patched last, if at all. PaperCut just reminded the security community what that neglect costs.
Researchers have confirmed active exploitation of a newly disclosed vulnerability chain in PaperCut NG and MF that lets an unauthenticated attacker execute arbitrary Java code on affected servers. No credentials. No foothold required. Just a reachable PaperCut instance and the right two-step sequence.
## How the Chain Works
The attack leverages two separate flaws — neither fatal alone, but lethal in combination. The first bug allows an unauthenticated attacker to manipulate PaperCut's trusted configuration layer. The second converts that configuration access into code execution by injecting arbitrary Java into the application's runtime.
That second step is what makes this particularly nasty. PaperCut runs as a service with elevated privileges on the host system. Getting Java code execution inside that context isn't just arbitrary code execution in the abstract — it's execution in a process that already holds keys to user credentials, printer queues, document logs, and often deep network access. From there, lateral movement is straightforward.
PaperCut released an emergency patch and pushed additional hardening measures, which suggests the company recognized the standard fix wasn't sufficient. When a vendor ships an emergency patch *and* supplements it with extra hardening, read between the lines: they knew the surface was bigger than the CVE description implied.
## This Is Not the First Time
Anyone who worked incident response in mid-2023 will feel a familiar knot in their stomach. That spring, CVE-2023-27350 — a critical authentication bypass in PaperCut — was weaponized at scale within days of disclosure. Clop, LockBit, and Iranian state-sponsored actors all used it. Schools, universities, and healthcare organizations bore the brunt of it because those are PaperCut's natural markets: institutions with large, distributed print environments, overworked IT teams, and patching cycles measured in weeks rather than hours.
The exploitation playbook then was the same as now: get in unauthenticated, execute code, deploy a backdoor or ransomware payload, pivot through the network. The tool changed. The technique didn't.
What changed is that the 2023 wave put PaperCut on every threat actor's research list. When you demonstrate that a target class is both widely deployed and slow to patch, you invite sustained attention. The security community patted itself on the back when organizations finally applied those fixes — but the researchers quietly kept looking.
## Who Should Be Worried Right Now
Universities and schools are the highest-risk population. PaperCut owns a dominant share of the higher education print management market. Campus environments are notoriously complex: decentralized IT, thousands of devices, and a culture of prioritizing uptime over security. Plenty of these systems are internet-adjacent, either by design or misconfiguration.
Healthcare organizations face a different risk calculus. Their PaperCut servers often sit on the same networks as clinical systems, imaging equipment, and EMR infrastructure. A compromised print server in a hospital isn't just an IT headache — it's a potential pivot point into systems that actually matter for patient care.
Mid-market enterprises with managed print environments are the overlooked segment here. They're less likely to have 24-hour SOC coverage, more likely to be running PaperCut in a set-it-and-forget-it configuration, and less likely to treat a print server as a meaningful attack surface until it's already been used against them.
## What Defenders Should Do Today
Patch immediately if you're on an affected PaperCut NG or MF version — the vendor's emergency fix addresses the chain. But don't stop there.
---
## HackWire Analysis
The framing around this vulnerability will focus on the technical novelty of the chain — two flaws, unauthenticated RCE, Java execution. That's the right story, but it's missing the institutional story underneath it.
PaperCut has now been a major exploitation vehicle twice in three years. Both times, the victims skewed heavily toward education and healthcare. Both times, the window between public disclosure and active exploitation was measured in days. And both times, the post-incident conversation fixated on the CVE details rather than the systemic question: why does print management software keep being the entry point?
The answer isn't that PaperCut writes uniquely bad code. It's that print management sits in a structural blind spot. It's not sexy enough to get proactive attention from security teams. It's not consumer-facing enough to generate regulatory pressure. It's deployed in environments — schools, hospitals, distributed enterprise campuses — where patching velocity is structurally slow. And it carries far more access and network trust than most administrators realize they've granted it.
Threat actors know this. They've done the math: high deployment base, slow patch rate, high network access, low security scrutiny. That's not a vulnerability. That's a category.
Until organizations start treating print servers with the same security posture they apply to application servers — network segmentation, minimal service account permissions, aggressive patch SLAs — PaperCut will keep showing up in incident reports. The next chain is probably already being researched.
The patch is necessary. It's not sufficient.
— HackWire Editorial
---
## Related Coverage