PaperCut Issues Comprehensive Update, Replaces Emergency Patches for Actively Exploited Vulnerabilities

PaperCut announced on Thursday that it is rolling out a new security maintenance release that supersedes the emergency patches previously issued to mitigate two vulnerabilities currently being leveraged by attackers.

The update targets the PaperCut NG and MF product lines, covering all supported versions of each. By bundling the fixes into a single maintenance release, the company aims to simplify deployment for administrators who were previously forced to apply multiple, time‑critical patches.

The two flaws at the heart of the emergency response are a remote code execution weakness and an authentication bypass issue, both of which have been confirmed as actively exploited in the wild. Security researchers observed exploit attempts shortly after the vulnerabilities were disclosed, prompting PaperCut to release rapid emergency patches to stem the immediate risk.

While the emergency patches were essential for short‑term protection, they were delivered as separate, out‑of‑cycle updates that could complicate change‑management processes in large organizations. The new maintenance release consolidates the corrective code, integrates it with the latest stable build, and eliminates the need for administrators to maintain a divergent patch set.

Customers are urged to apply the maintenance release as soon as possible to ensure that the mitigations are fully effective. PaperCut has provided detailed installation instructions and recommends testing the update in a staging environment before broad deployment, especially for enterprises with heavily customized print‑management configurations.

Looking ahead, the vendor says it will continue to monitor the threat landscape and work with security partners to identify any further weaknesses. The incident underscores the importance of timely patch management for print‑services software, which, despite its low profile, can serve as a gateway for broader network compromise if left unaddressed.