PaperCut Zero-Day Flaws Resurface in Data Theft Campaigns After Recent Patch

Security researchers have confirmed that two critical flaws in PaperCut NG and MF print‑management software, which were patched only last week, are now being leveraged in active data‑theft operations. The vulnerabilities, initially disclosed as zero‑day exploits, allowed attackers to extract sensitive files from compromised networks before the vendor released fixes.

The flaws affect the way PaperCut processes print jobs and manages authentication tokens. By manipulating specially crafted requests, threat actors could bypass access controls and retrieve documents stored on the print server, including confidential reports, invoices, and personal data. Although the vendor issued patches promptly after the initial discovery, evidence shows that malicious actors have adapted their tools to target systems that remain unpatched.

Cyber‑security firm SentinelOne, which first observed the post‑patch abuse, reported that the attacks have been detected across multiple sectors, ranging from educational institutions to corporate offices. In several incidents, the compromised servers were used as stepping stones to exfiltrate data to external command‑and‑control servers, often employing encrypted channels to evade detection.

PaperCut’s parent company, PaperCut Software International, responded by issuing an advisory urging administrators to apply the latest updates immediately and to review server logs for any signs of unauthorized access. The company also recommended disabling remote access to the management console where feasible and implementing network segmentation to limit the potential impact of a breach.

Experts emphasize that the rapid exploitation of the zero‑day patches underscores a broader challenge in the cybersecurity landscape: the window between vulnerability disclosure, patch release, and real‑world exploitation is shrinking. “Attackers are quick to weaponize newly disclosed flaws, especially when the vulnerable software is widely deployed in organizations that may lag in patch management,” said Maya Patel, a senior analyst at the Information Security Institute.

IT teams are advised to verify that all PaperCut installations are running the latest versions—PaperCut NG 21.2.6 and PaperCut MF 21.2.6—or newer, and to conduct thorough scans for indicators of compromise. Organizations that cannot update immediately should consider temporary mitigations such as restricting printer access to trusted subnets and enforcing multi‑factor authentication for administrative accounts.

The incidents also raise questions about the adequacy of existing security controls around print infrastructure, which traditionally receives less scrutiny than other network assets. As more enterprises adopt cloud‑based or hybrid printing solutions, ensuring robust monitoring and timely patch deployment becomes essential to prevent similar abuse.

While no large‑scale data breach linked directly to the PaperCut exploits has been publicly confirmed, the ongoing attacks serve as a reminder that even niche software can become a vector for sophisticated threat actors. Continued vigilance, prompt patching, and comprehensive logging are critical steps for organizations aiming to safeguard their print environments against future threats.