Contents
URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)
THE PAGE APPLIES TO:
Last updated August 29, 2026
Contents
URGENT Security Advisory
PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.
We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing. We will update this security bulletin as verified information becomes available, including indicators of compromise and remediation guidance.
Immediate action required
If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses).
Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.
Emergency Patch Release 2
This is an emergency patch for customers with public-facing PaperCut NG/MF servers who are unable to take other mitigating action.
[Update: 28 August 2026 8:42pm (AEST)]
Following further work with our internal security team and external researchers, including Huntress and watchTowr, we have released an updated Emergency Patch (Release 2) that includes additional hardening beyond the original emergency patch. We recommend all customers install Release 2, even if you have already applied the original emergency patch.
Download and follow the standard upgrade procedure.
PaperCut MF
MF Version | Download links | Checksums (SHA256) |
v26 | 5c63ef18c523c85d5e73efc7fbb2bd2edacf0b03bcf80fe4d7e4c1a7c8bcbcf4 | |
6117b53dd0610052c53aeafced91cd3d0ad80ed1dcc578e873291a8b697b802a | ||
7dea84473f8d00d4608b7e797b633f130139e23bf5bba02848a1df0a7e2cc7c6 | ||
v25 | b296de7da020152a83291378ab4ca5c461d76510648347fd6e69f3fb2cd5e9c9 | |
296498ef5ec1ac8927dc1ccae9a9aa3c04036da6d2768813e6df818049b3f4a1 | ||
3e5509f0514228031967934d32e4a40512bd6fb5857bfde3002866bc3ede3f9a | ||
v24 | 75aba456d6629848c89513371c44037f2bdddbc1e39bdadc16d1fed8b59766eb | |
7ac8f002fb602d1f54665d8a18a25fc57cf41239ae0c03b18591ee220b57d419 | ||
40581392cc11a1f46b90ab5c2607fdacade77aca0de6629c1d78a2a71548fc9c |
PaperCut NG
NG Version | Download links | Checksums (SHA256) |
v26 | c9a2b356910b5fef3c114d48cb7c508414d1d35ddac74c530d1e8923d357e7d4 | |
3261356ced056fd5ab0962a07178701e80c6ebbce30d7158d20ed3c57b1dcf59 | ||
bdd54d5cb9f20924b059986a44f849df499f7de7cb5cd0a60290d2b2610850e7 | ||
v25 | b155cf19cdab1b7fc92c2dd030d1c0cd439397d83d7749042f65e2364ca03589 | |
282be7404a25c12317a2079eed59e8794f0c9d7bd257dee60c39b529da18a46a | ||
276ee64a7bb4d4e242fe7ddaecf3cd279eee91e83fbd1e6f44050db2f90bda6d | ||
v24 | f58a3fe4e9d7543c38a3f01e53f4a9ad34884289a71df25f734af9d977c06319 | |
a7ea1e2cdb22a4349ae854491b10b89a52d075e9106ec68f838f12d5f2a15f51 | ||
1e70dd6510d0b9618035a3db462b78ece06cd70f41bcccca8196c015c46a480b |
Post Install Check:
- Are you using an external database for Card/ID number lookups? Review the FAQ below.
- Using site-servers? Review the FAQ below.
Security issues addressed
Our security team has now made public the following two CVE’s.
| CVE | Notes | CVSS rating and vector |
| CVE-2026-82078 Unsafe Dynamic Class Loading in Database Connector | An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. Vulnerability Type: CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection'). Impact: If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. Mitigated in: PaperCut NG/MF Emergency Patch Release 2 (see above). | 9.4 (CRITICAL)
|
| CVE-2026-81578 Authentication Bypass | An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. Vulnerability Type: CWE-306 Missing authentication for critical function. Impact: This allows an unauthenticated remote attacker to modify certain system configurations. Mitigated in: PaperCut NG/MF Emergency Patch Release 2 (see above). | 8.8 (HIGH)
|
Who is potentially impacted
This advisory applies to all versions of:
- PaperCut NG
- PaperCut MF
Indicators of compromise and investigation guidance
The following may be indicators of compromise:
-
Alerts from intrusion-detection, endpoint-security, or network-monitoring tools involving the PaperCut Application Server, particularly suspicious post-exploitation activity from
pc-app.exe. -
Missing, unexpectedly truncated, or deleted PaperCut
server.logfiles. -
Any of the following entries in server.log:
ERROR No suitable driver found for jdbc:no:xERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
Important: The absence of the above indicators is not confirmation that a system has not been affected. PaperCut will publish validated, specific indicators and further guidance here as soon as they are available.
Current Status
Update | Details |
Investigation progress | PaperCut’s security emergency response team has used information provided by a university customer’s security team and digital forensics and incident response team. This information has enabled PaperCut to reproduce a vulnerability in the PaperCut NG and PaperCut MF code. Our emergency engineering team is developing and validating an appropriate code fix. |
Emergency patch released | An emergency patch is available for v25 and v26. See download links above and follow the upgrade process. |
Emergency Patch Release 2 published | An updated Emergency Patch (Release 2) is now available for v24, v25, and v26, including additional hardening. We recommend all customers install Release 2 in place of the original emergency patch. See download links above and follow the upgrade process. Our emergency security response team will be continuing to work over the weekend. |
Post-patch issue reports | [29th August 2026, 04:35pm (AEST)] We have received some reports that the external database Card/ID number lookup feature and SAML are not working as expected after applying the patch. We are investigating and will update this bulletin as soon as we have more information. |
FAQs
Q Is this an official release?
No. We have not gone through our usual release process. This is an emergency patch for customers with public-facing PaperCut servers who are unable to take other mitigating action. More information will be published as it becomes available.
Q Do I need to update other components (e.g. Site Servers and Secondary servers)?
Site Servers and secondary/print servers should be updated to a patched version, not just the primary Application Server.
Other components such as Print Deploy and Mobility Print are not affected and do not need to be updated.
Q What should I do if I suspect my server has been compromised?
If you suspect your server has been compromised, we recommend securing current server backups, completely wiping and rebuilding the Application Server, and restoring a clean backup taken before any suspicious behavior was detected. Additionally, you should activate your organization's security response procedures and follow standard incident protocols.
Our insight into individual environments is limited, so we cannot confirm or assess the full scope of impact from a compromised server.
Q Will there be a release for NG/MF 23 and earlier?
The recommended path for all customers prior to PaperCut NG/MF v24 is to upgrade to the latest version.
Q My install uses an external database for card number lookups, what changes are required?
This is a rarely used feature and most customers will not need to take any action, for those that do, follow these steps:
Add security.card-number-lookup.enabled=Y to server/security.properties and restart the Application Server.
The default setting for this feature is off (N) which disables the feature. Without this key set, PaperCut NG/MF will silently ignore any external user lookup calls even though the Admin UI may still show the feature as configured.
Q How do I apply the Emergency Patch?
Download and follow the standard upgrade procedure.
Security notifications
To stay informed about high impact security updates please subscribe to our Security notifications sign-up form.
Updates
Date | Update/action |
27 August 2026 (AEST) | Published the initial Security Bulletin. |
27 August 2026, 8:00pm (AEST) | Minor wording updates. |
27 August 2026, 9:02pm (AEST) | Investigation update posted. |
28 August 2026, 02:10am (AEST) | Published emergency patch. Patch released for PaperCut NG/MF v25 and v26. |
28 August 2026, 10:43am (AEST) | Additional information added for customers using Card/ID number lookups from an external database. |
28 August 2026, 08:42pm (AEST) | Published Emergency Patch Release 2 which includes additional hardening developed with internal security and external researchers. Added guidance on required PaperCut would like to thank Huntress and watchTowr for their ongoing security analysis, helping to harden Release 2. |
28 August 2026, 10:08pm (AEST) | Published Emergency Patch Release 2 for PaperCut NG/MF v24. |
29 August 2026, 10:53am (AEST) | Additional FAQ added. |
29 August 2026, 04:35pm (AEST) | Added note about external database Card/ID number lookup feature and SAML investigation. |
Category: Security Bulletins
Subcategory: Security and Privacy
Comments
Comments are not available in this preview environment. On papercut.com, this space shows the live Disqus comment thread for this page.