PaperCut Zero-Day Hits All Versions—Only 25 and 26 Have Emergency Patches

PaperCut NG and MF servers are under active exploitation, and administrators should treat every release as potentially affected. BleepingComputer’s account of the attacks describes confirmed customer incidents and public-facing Application Server interfaces as the immediate exposure concern.

On August 28, 2026, PaperCut’s updated security bulletin made emergency builds available for versions 25 and 26 of NG and MF on Windows, Linux and macOS. Version 24 builds remained in progress, while the vendor continued to advise every customer with a publicly accessible Application Server to restrict web access to trusted IP addresses immediately.

Public reachability determines the immediate exposure

The first question is whether an untrusted internet address can reach any PaperCut Application Server web interface. Administrators should check more than the server’s assigned addresses: firewall and network-address-translation rules, reverse proxies, load balancers, cloud security groups and temporary third-party access paths can all make an otherwise internal system reachable.

If any public route exists, block it with firewall rules, network access controls or an equivalent restriction that permits only trusted addresses. Where remote administration remains necessary, use a VPN or another controlled path instead of direct public access.

Internal-only reachability lowers exposure to opportunistic internet attacks, but it does not prove that the server was never exposed or never compromised. Record the current network state, reconstruct any earlier exposure window and consider access from connected third parties, broadly reachable internal segments or already-compromised systems.

The response differs by installed major version

Network containment applies to every release, but emergency-patch availability is version-specific. Administrators should identify the exact product, major version and operating system before selecting a package:

• Version 26: Emergency installers are available for PaperCut NG and MF on Windows, Linux and macOS. Restrict public access first, preserve evidence if exposure existed, verify the installer against its published SHA-256 checksum and then deploy it through a controlled change process.
• Version 25: Emergency installers are available for both products across the same operating-system families. These builds have not completed PaperCut’s usual release process.
• Version 24: Emergency builds are still being prepared. Isolation remains the immediate protection until a build is published or the installation is upgraded to a patched branch.
• Earlier versions: They remain within the potentially affected scope, but no dedicated emergency package is listed. Keep them isolated and plan an upgrade rather than treating their age as evidence that they are unaffected.

The emergency builds also change external Card/ID database lookups: SQL queries used by that feature can no longer contain EXEC, EXECUTE or CALL statements. Administrators using those lookups should assess the compatibility effect, but that review should not delay containment of public access.

Observed attacks achieved pre-authentication code execution

Huntress’s technical incident report documents exploitation in two customer environments and a reproduced pre-authentication remote-code-execution chain against PaperCut NG 25.0.11.75758. Crafted requests exploited an authorization mismatch, changed trusted server configuration and enabled attacker-controlled Java code to run inside the application process.

Observed commands included whoami & ver, used to identify the Windows account and operating-system version, and tasklist, which enumerates running processes. Responders also recovered malicious Java class files named Udydn.class and Moo97.class from a PaperCut MF installation.

The recovered code could profile Windows or Linux systems, list directories, write temporary output and remove artifacts afterward. It deleted its output, PaperCut’s server.log and Derby logging data, meaning an ordinary-looking local log set cannot clear a previously exposed server.

The reproduced chain used an attacker-controlled SMB2 share to deliver a Derby archive. Where operationally possible, unexplained outbound SMB from an Application Server should be restricted or investigated, although such traffic alone does not establish exploitation.

Contain first and preserve evidence before remediation

For a publicly exposed server, network containment and evidence preservation should precede an upgrade or restart. Either action can alter logs, volatile process information and filesystem metadata needed to reconstruct the intrusion.

1. Block untrusted access to every Application Server web interface, then record the time and the network rules changed.
2. Record whether the installation is NG or MF, its exact version, operating system, listening interfaces and known or estimated exposure window.
3. Preserve the complete PaperCut server/logs directory with timestamps and metadata, along with current and non-default configuration.
4. Capture endpoint telemetry and process trees in which execution originates from pc-app.exe, plus recent services, scheduled tasks, autoruns and files created on the server.
5. Export relevant reverse-proxy, WAF, firewall, DNS and network-flow records before retention limits or rotation remove them.
6. After evidence capture, deploy the applicable version 25 or 26 emergency build, or maintain isolation while moving an older installation to a fixed branch.

Missing indicators do not clear an exposed server

Published investigation leads include suspicious child activity originating from pc-app.exe; missing, truncated or deleted server.log files; and the fragments ERROR No suitable driver found for jdbc:no:x and ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST. Additional observed artifacts include Udydn.class, Moo97.class and a log entry containing DB URL: jdbc:derby:memory:pwn.

These artifacts are leads rather than a complete detection rule set. Searches should extend to endpoint, network and centralized telemetry because the observed payload could remove local output and logs. A negative search therefore cannot outweigh evidence that a server was publicly reachable while unpatched.

At publication time, active exploitation and customer incidents were established, every PaperCut NG and MF version remained potentially affected, and emergency builds existed only for versions 25 and 26. Version 24 builds, additional validated indicators and fuller remediation guidance were still pending; the attackers and any possible data theft had not been publicly identified.

Also read:

• How to Stay Healthy and Active Throughout the Day
• Part 3. The Illusion of Value: Why 90% of Crypto Projects Have Billion-Dollar Market Caps But Almost Zero Traffic and Revenue
• Franchise SEO Scales Only When Every Location Keeps Its Own Proof