PaperCut Zero-Day Exploits Let Hackers Control Enterprise Systems

When Print Management Turns Into a Playground for Hackers

Enterprise print‑management suites like PaperCut NG and its mobile‑friendly counterpart, PaperCut MF, have long been considered reliable workhorses. Yet in late August 2026, security researchers discovered a pair of critical flaws that let attackers chain together a remote‑code‑execution (RCE) vector without needing any authentication. The result: an unauthenticated attacker could run arbitrary Java code inside the application, effectively gaining full control of the underlying server.

Two Flaws, One Deadly Combination

According to a patch note released by PaperCut on August 28, the first vulnerability (CVE‑2026‑xxxx) allowed an unauthenticated user to read configuration files that contained privileged credentials. The second flaw (CVE‑2026‑xxxx) enabled the execution of arbitrary code via a malformed XML payload. When combined, the two zero‑days created a straight‑line path from a public web endpoint to full system compromise.

Hackread reported that the exploitation chain was already in use against at least 15 organizations in the United States and Europe. In one documented case, a manufacturing firm lost control of its document‑routing system for 12 hours before the patch was applied.

Why the Patch Matters for Enterprise IT

The emergency fix, released as a hot‑fix update, hardens the application’s trust boundary and sanitizes all external inputs. PaperCut’s team also added logging enhancements to surface suspicious activity earlier. While the patch itself is straightforward, the incident highlights a broader trend: legacy enterprise software often lags behind modern security practices, leaving critical paths exposed.

What Attackers Can Do With Remote Code Execution

• Install backdoors and maintain persistence
• Extract sensitive documents and credentials
• Pivot to other systems in the same network
• Use the compromised server as a staging point for further attacks

Stat Snapshot: The Numbers Behind the Attack

Comparing PaperCut to Competitors

Industry Response and Lessons Learned

Security firms now advise enterprises to treat print‑management software as a critical asset, subject to the same rigorous patch management as operating systems. Multi‑factor authentication (MFA) is no longer optional; it is a baseline requirement for any software that exposes configuration endpoints over the network.

In the wake of the PaperCut incident, the National Institute of Standards and Technology (NIST) updated its guidelines to recommend automated vulnerability scanning for all Java‑based web applications, including those that are not traditionally viewed as high‑risk.