# PaperCut Gets Hit Again: Zero-Day Attacks Expose the Print Management Problem Nobody Fixed
Print management software doesn't get the threat intel coverage it deserves. Then something like this happens — and the same organizations that scrambled through PaperCut's 2023 crisis are scrambling again.
PaperCut confirmed this week that attackers are actively exploiting an unpatched vulnerability across all versions of both PaperCut NG and PaperCut MF, its two primary enterprise print management platforms. The company is warning customers to take immediate action while patches are being developed — which is another way of saying: you are currently exposed with no complete fix available.
## The Software That Runs Every University Printer
PaperCut is not niche software. It manages printing across hundreds of thousands of organizations globally — universities, hospitals, law firms, government agencies. It handles authentication, billing, quotas, and device management for entire printer fleets. If you've printed something at a university in the last decade, odds are PaperCut touched that job.
That ubiquity is exactly what makes this software attractive to attackers, and exactly why this is the second major exploitation cycle in roughly three years.
In April 2023, PaperCut was in the exact same position. Two critical vulnerabilities — CVE-2023-27350 and CVE-2023-27351 — were being actively exploited within days of disclosure. Clop and LockBit ransomware affiliates weaponized those flaws almost immediately, and the attacks hit hard in education and healthcare, sectors where PaperCut is deeply embedded and IT resources are already stretched. CISA added the flaws to its Known Exploited Vulnerabilities catalog. The FBI issued advisories. It was a mess.
Now it's happening again.
## What "Zero-Day" Means Here
The designation matters. This isn't a patched vulnerability that organizations failed to apply — it's a flaw being exploited before a fix exists. The timeline is brutal: attackers know about it, are using it in the wild, and defenders have no complete remediation path yet. PaperCut is advising customers to apply workarounds and limit exposure while it works on a patch.
The specific technical details of the flaw have not been fully disclosed — standard practice to avoid handing a wider attacker population a working playbook before a patch lands. What is known is that the vulnerability affects all current versions of both NG and MF, which means the entire active install base is in scope.
PaperCut NG targets smaller environments; MF handles enterprise deployments with advanced workflow capabilities. Together they represent the bulk of PaperCut's market. There is no version to fall back to.
## Who's Actually Running These
The attack surface here has a specific shape worth mapping:
In each of these sectors, print management servers tend to live in internal network segments that are treated as trusted. That trust is the attack vector.
## The Workaround Window Is Not Comfortable
PaperCut's guidance while patches are in development typically centers on restricting access to the Application Server's management interface — blocking external access, limiting which IPs can reach administrative ports, and monitoring for anomalous print job activity or server-side execution events.
That's reasonable hardening advice, but it assumes defenders know what normal looks like on their PaperCut deployment. Many don't. The platform gets installed, it works, and it lives in a corner of the network that only the help desk thinks about. Alert rules for PaperCut anomalies are not standard in most SIEM configurations.
The detection gap is as dangerous as the vulnerability itself.
---
## HackWire Analysis
The 2023 PaperCut incidents should have been a forcing function. They weren't.
What the 2023 attacks demonstrated — and what this new zero-day confirms — is that print management software occupies a dangerous position in enterprise security posture: it's operationally critical, widely networked, often runs with elevated privileges, and is almost never included in vulnerability management programs with the same rigor as web applications or endpoint software.
The pattern is clear enough to name: attackers have identified an entire category of "infrastructure middleware" — print management, building access software, industrial scheduling systems, VoIP management platforms — that organizations treat as appliances rather than attack surfaces. These products often have web interfaces, run with service account privileges, and sit inside network perimeters without modern EDR coverage. They're not glamorous targets, but they're effective ones.
PaperCut specifically has now proven twice that it's a high-return target. Ransomware operators understand that a compromised print server in a university environment gives them lateral movement options across a segmented but still reachable network. Healthcare operators running MF have document workflows and service account credentials worth more than the print server itself.
The missing piece in most post-incident coverage is the detection side. Defenders need PaperCut-specific detection content — log sources, behavioral baselines, server-side execution anomalies. If your SIEM has no rules for PaperCut, build them before a patch arrives, not after. The workaround window is where the attackers are operating right now.
Organizations that lived through 2023 and didn't add PaperCut to their formal vulnerability management program are about to learn the same lesson twice.
— HackWire Editorial
---
## Related Coverage