# Your Print Server Is an Attack Surface Again: PaperCut Closes Two Actively Exploited Holes
PaperCut's print management software has a habit of showing up in incident reports. This week, the Australian company formalized its response to a pair of vulnerabilities that attackers had already found useful enough to exploit in the wild — retiring the emergency patches it rushed out earlier and replacing them with proper maintenance releases across three supported version branches.
PaperCut NG and MF versions 26.0.5, 25.0.13, and 24.1.10 are now available. If your organization runs PaperCut and hasn't updated, the window between "vulnerability disclosed" and "attackers inside your network" is already past.
## The Emergency-to-Maintenance Pipeline
The interesting detail here isn't just that patches dropped — it's *how* they dropped, and what that sequence tells you about the severity of what came before.
Emergency patches exist because the normal release cycle is too slow. When PaperCut pushed out-of-band fixes earlier, the implicit message was: this cannot wait for the next maintenance release. That's a high bar. Now those emergency patches have been superseded by official maintenance releases, which means two things for defenders. First, if you applied the emergency patches, you still need to upgrade — emergency fixes are often surgical and don't always include the full hardening that follows. Second, organizations running automated patch management that targets official maintenance releases only may have been flying unprotected in the interim.
That gap — between "emergency fix available" and "official MR ships" — is real operational risk, and it's one most patch management programs aren't built to handle cleanly.
## PaperCut's History of Being a Target
This isn't the first time. In April 2023, CVE-2023-27350 and CVE-2023-27351 shook the PaperCut user base when researchers at Huntress documented active exploitation within days of disclosure. The Cl0p ransomware group and Iranian state-sponsored actors both moved on the vulnerabilities fast. Schools, universities, and government agencies — PaperCut's core customer base — got hit hard.
The 2023 campaign was a reminder that print management software sits in a peculiar place in the enterprise: deeply privileged (it runs as a service with broad access to user credentials and document content), widely deployed across campuses and offices, and systematically under-scrutinized in security reviews. When was the last time your red team specifically targeted your print server infrastructure?
The answer at most organizations is: never.
## What's Actually at Risk
PaperCut NG and MF aren't just queue managers. In enterprise deployments, they authenticate against Active Directory, handle cost allocation tied to user accounts, and often sit on segments with broad internal network access. An attacker who compromises a PaperCut server doesn't just get print jobs — they frequently get a foothold with domain credentials, visibility into user activity patterns, and a pivot point into internal segments that are otherwise well-defended.
The software is particularly concentrated in:
In each of these verticals, the blast radius of a successful exploitation isn't just "attacker gets shell on print server." It's "attacker has a beachhead in an environment full of sensitive data and a security team that wasn't expecting the threat to come from the printer."
## Patching Isn't Enough — Check for Indicators of Compromise First
When vulnerabilities are described as "actively exploited," the patch is only half the work. Organizations should treat this as a potential incident response scenario, not just a maintenance window.
Before or alongside patching, administrators running PaperCut should:
The moment you see "actively exploited" in a vendor advisory, the question isn't just "did I patch?" It's "was I already hit?"
## Version Branches and the Patching Calculus
PaperCut has addressed the flaws across three version lines: 24.1.10, 25.0.13, and 26.0.5. Organizations running versions older than the 24.x branch should treat this as a hard trigger to upgrade — not just patch, but upgrade, because end-of-life branches often don't receive security fixes at all, and running unsupported PaperCut in a post-exploitation environment is an unacceptable position.
The multi-branch fix is notable because it acknowledges that real enterprise environments don't all run the latest version. PaperCut's decision to backport fixes is the right call, and defenders should take advantage of it rather than treating this as just another version bump.
---
## HackWire Analysis
The recurring PaperCut vulnerability cycle points to a structural problem in enterprise security posture that goes beyond any single software vendor: the print and document management stack is systematically excluded from serious threat modeling.
Security teams spend enormous energy on endpoint detection, email security, and perimeter controls. Print management software — which in many deployments runs as a privileged Windows service with AD integration, stores documents, and handles authentication for thousands of users — gets reviewed approximately never unless something goes wrong.
PaperCut specifically has now been the subject of multiple critical exploitation campaigns in a three-year window. That's not bad luck. That's a high-value, under-defended target class that attackers have learned to prioritize. The 2023 Cl0p and Iranian APT activity demonstrated that nation-state and ransomware operators both find print management infrastructure worth their time. The new flaws, already under active exploitation before formal patches shipped, confirm that interest hasn't faded.
What other reporting is missing: the emergency patch lifecycle gap is a real risk vector. Organizations that applied the original out-of-band fixes and considered themselves done are now running a known-incomplete fix in an actively-exploited threat environment. The upgrade to an official MR isn't optional housekeeping — it's incident response.
For defenders in education and healthcare especially: PaperCut should be on your asset inventory with a dedicated patch SLA, your PaperCut service account should be scoped to minimum necessary AD permissions, and you should have a log review cadence that isn't "when something breaks." The attackers already know PaperCut is worth targeting. The question is whether your security program does.
— HackWire Editorial
---
## Related Coverage