# PaperCut's Patch Problem: When the Fix Needs a Fix
Print management software rarely makes security headlines. That's exactly the problem.
PaperCut has pushed a second emergency patch for two actively exploited vulnerabilities in PaperCut NG and MF after researchers found that the initial fixes could be bypassed. The company didn't just miscalculate once — it shipped a patch, called it done, and then watched researchers walk right through it. That's not a bad day. That's a root cause analysis failure.
## What Actually Happened
Two vulnerabilities in PaperCut's widely deployed print management platform were being actively exploited in the wild when PaperCut issued its first emergency update. The initial patch was meant to close both holes. It didn't. Security researchers subsequently discovered multiple bypass methods, meaning organizations that had patched — believing themselves protected — remained exposed.
PaperCut then issued a second emergency update to address what the first one missed.
The vulnerabilities affect PaperCut NG and PaperCut MF, which are the two flagship products used across enterprise, education, and government environments. PaperCut claims over 100 million users across 70,000 organizations in 140 countries. That is not a niche footprint. That is the global print floor.
## This Is Not PaperCut's First Rodeo
If this situation feels familiar, it should.
In April 2023, PaperCut disclosed CVE-2023-27350, a critical unauthenticated remote code execution flaw that was quickly picked up by ransomware operators and state-sponsored groups. The Cl0p ransomware gang weaponized it. Iranian threat actors linked to Mango Sandstorm used it. LockBit affiliates hit it. PaperCut servers became a meaningful point of entry for a stretch of weeks because the software sits on network-accessible systems, often with elevated privileges, and organizations treat print servers like they're invisible infrastructure.
The lesson defenders should have taken from 2023: PaperCut is a high-value lateral movement and initial access vector precisely because nobody thinks about it. When a researcher can compromise a print server, they can often pivot from there into domain infrastructure, access shared drives, and move quietly while incident response is focused elsewhere.
That lesson apparently needed to be refreshed.
## The Bypass Problem Is Broader Than One Vendor
Patch bypasses are becoming an uncomfortable trend across enterprise software. The dynamic follows a predictable script: a vulnerability gets disclosed, a patch ships under pressure, the vendor marks it resolved, and then a second or third researcher — often motivated by the original disclosure — starts poking at the edges of the fix. They find that the patch addressed one code path but not the underlying logic flaw. Or the sanitization was applied in the wrong layer. Or the fix was correct for the specific proof-of-concept but not for a variant.
We've seen this with Ivanti, with Cisco, with Fortinet. The 2024–2025 period has been particularly rough for network edge devices and management platforms, where vendors rushed fixes into production without sufficient variant analysis. PaperCut's second emergency patch fits that pattern.
The pressure vendors face to ship quickly is real — active exploitation creates genuine urgency and customers demand action. But shipping an incomplete fix that generates false confidence may be worse than taking an extra 48 hours to do it right.
## Who's Exposed Right Now
Organizations running unpatched or first-patch PaperCut installations are the obvious concern. But the real exposure map is messier than that.
Higher education is disproportionately affected. Universities are among the heaviest PaperCut deployments on the planet, running it across student labs, library systems, and administrative offices. Their patch cycles are slower than enterprise environments, their IT teams are stretched thin, and their networks are notoriously flat. A compromised print server at a major research university is a meaningful intelligence target.
Healthcare and government also run PaperCut. Both sectors face the same problem: long patch approval cycles, complex change management processes, and a culture that deprioritizes "supporting infrastructure" like print management. Print servers don't have SLAs. They don't have incident response playbooks. They get patched when someone remembers.
Managed service providers are a multiplier. MSPs that deploy PaperCut across their client base and haven't pushed the second patch have now created a single point of failure across potentially dozens of organizations.
## What Defenders Should Actually Do
Beyond the obvious "apply the second patch immediately," there are concrete steps:
## The Transparency Gap
One thing worth naming: PaperCut's communication around this incident has been thin on technical specifics. When a vendor ships a bypass of a bypass, defenders need to understand *why* the first fix failed — not just that it did. Understanding the nature of the bypass helps security teams assess whether there are adjacent issues the second patch might also miss, and it lets researchers prioritize further scrutiny.
Vendors have gotten better at disclosing vulnerabilities under pressure from the broader community. They're still not great at disclosing their own patch failures honestly and technically. That gap costs defenders time they don't have.
---
## HackWire Analysis
The PaperCut situation is a case study in infrastructure blind spots and the compounding cost of patch complacency.
What makes this particularly dangerous isn't the bypass itself — patch bypasses happen, and the security community has come to treat them as an expected part of the disclosure lifecycle. The real problem is the false confidence window. Every hour between a vendor saying "we've patched this" and a researcher proving they haven't is an hour when defenders stop watching, stop logging at elevated levels, and stop treating the system as under active threat. Attackers know this. They time exploitation around patch announcements precisely because security teams relax.
PaperCut's 2023 exploitation wave should have permanently elevated this software's status in enterprise threat models. The fact that we're here again — with another emergency patch, another bypass, another actively-exploited window — suggests it didn't. Security teams still aren't thinking about print servers the way they think about firewalls or VPNs, even though the blast radius of a compromised print server can be just as severe.
The trend worth watching: management and monitoring platforms across the board have become preferred initial access targets. They're trusted, they're networked, and they're under-monitored. PaperCut isn't unique in being exploited — it's representative of a class of "invisible infrastructure" that attackers have figured out is anything but invisible from a network perspective. Expect more of these disclosures across print, facilities, and building management software categories through the rest of 2026 as researchers and threat actors alike turn their attention to the unsexy corners of enterprise networks.
Defenders should stop thinking about this as a print management problem and start thinking about it as an infrastructure access problem. The patch is mandatory. The mindset shift is more important.
— HackWire Editorial
---
## Related Coverage