The PaperCut vulnerability to act on now is the August 2026 NG/MF emergency: CVE-2026-82078, a Critical CVSS 9.4 unsafe dynamic class-loading flaw, and CVE-2026-81578, a High CVSS 8.8 authentication-bypass flaw. If you run PaperCut NG or PaperCut MF, install Emergency Patch Release 3 for v24, v25, or v26 and restrict web interface access to trusted IPs immediately.
PaperCut vulnerability: what changed on September 1, 2026
PaperCut published its urgent advisory on August 27, 2026, then moved fast. By September 1 at 18:22 AEST, the company had published Emergency Patch Release 3 for PaperCut NG/MF v24, v25, and v26.
That third release matters because it supersedes Release 2, is cumulative, and is recommended for all internet-facing Application Servers, including servers already patched with earlier emergency releases. In plain English: if you stopped at the first or second emergency patch, you’re not done.
PaperCut says confirmed customer incidents exist and that its security response team is investigating active exploitation affecting PaperCut NG and MF. The company’s August incident write-up says the first report came from an education-sector customer whose PaperCut MF server appeared compromised at 9:42 a.m. AEST on August 27, 2026.
Canadian Centre for Cyber Security also warned on August 28, 2026, that open-source reporting indicated CVE-2026-81578 and CVE-2026-82078 were being exploited in the wild. SecurityWeek and BleepingComputer reported the emergency patch sequence the same week. For admins, the safest reading is simple: treat this as active, not theoretical.
Which PaperCut products are affected?
The affected products in the August 27, 2026 bulletin are PaperCut NG and PaperCut MF. PaperCut says Hive, Pocket, Mobility Print, Print Deploy server/client, and User Client are not affected by this specific bulletin.
Older deployments need special attention. Emergency Patch Release 3 is published for NG/MF v24, v25, and v26; customers running versions before v24 are advised by PaperCut to upgrade to the latest version. Honestly, keeping a print-management application before v24 on the public internet in September 2026 is asking too much of luck.
Version confusion is the pitfall many teams miss. A school district or company may have NG/MF on one server, Print Deploy components elsewhere, and Mobility Print in the mix. Don’t assume patching one PaperCut-branded component means the vulnerable Application Server has been fixed.
| 2026 item | Affected or fixed product | Admin action |
|---|---|---|
| CVE-2026-82078, CVSS 9.4 Critical | PaperCut NG/MF | Install Emergency Patch Release 3 for v24-v26 |
| CVE-2026-81578, CVSS 8.8 High | PaperCut NG/MF | Install Emergency Patch Release 3 and restrict web access |
| Emergency Patch Release 3, September 1 | PaperCut NG/MF v24, v25, v26 | Apply even if Release 1 or 2 was already installed |
| Pre-v24 NG/MF deployments | Older PaperCut NG/MF | Upgrade to the latest supported version |
| CVE-2026-6645, June 2026 | Print Deploy Client v2699 / server 1.10.4178 | Check separately; not the August NG/MF bulletin |
| CVE-2026-8793 and CVE-2026-8794, August 3 | PaperCut NG/MF 26.0.3 | Verify base version history before emergency patching |
Patch first, then narrow exposure
PaperCut’s own instruction is blunt: restrict public-internet access to NG/MF web interfaces to trusted IP addresses immediately, even where no suspicious activity is observed. I’d do that before lunch, not after a change board next week.
A useful way to prioritize is to count exposed Application Servers, not total printers. One vulnerable NG/MF server managing 400 printers is one external application risk, but it may also be one route into identity, print queues, card lookup data, and internal network paths. If you have 12 regional servers and four are internet-facing, your first-hour job is those four.
For teams formalizing access controls, the logic maps neatly to Zero Trust verification rather than broad admin exposure. Allow known VPN ranges, management jump hosts, or trusted office IPs; block the rest. Then check whether users still need direct access at all.
Patch sequencing also deserves care. Release 3 fixes two known regressions from earlier emergency patches: broken SAML login flows and legacy Microsoft SQL Server driver support for external card lookup. That means some admins who hesitated because Release 1 or 2 broke authentication or lookup integrations now have a stronger reason to move.
A practical response checklist for admins
The PaperCut vulnerability response should be boring and documented. Panic produces missed servers. A short runbook, followed exactly, beats heroic guessing.
- Identify every PaperCut NG/MF Application Server and record its version: v24, v25, v26, or pre-v24.
- Find internet-facing web interfaces using firewall rules, reverse proxies, DNS records, and external attack-surface scans.
- Restrict access to trusted IP ranges immediately, even if logs look clean.
- Install Emergency Patch Release 3 on NG/MF v24, v25, and v26; upgrade pre-v24 deployments to the latest version.
- Confirm SAML login and external card lookup still work, especially if you use a legacy Microsoft SQL Server driver.
- Review PaperCut’s August 30, 2026 indicators of compromise and preserve relevant logs before rotation.
- Feed events into monitoring so follow-on activity doesn’t disappear after patching.
Detection should not rely only on the product console. If your organization uses centralized logging, tie PaperCut web activity, authentication events, and server process behavior into your monitoring stack; this is where SIEM-based threat detection earns its keep.
Behavior analytics can help too, but keep expectations grounded. A compromised print server suddenly authenticating to unusual systems or touching abnormal shares may stand out in UEBA account and behavior monitoring, while the original exploit attempt may be easier to see in web logs and endpoint telemetry.
Why this feels familiar: the 2023 PaperCut lesson
PaperCut has been here before. In March 2023, the company fixed CVE-2023-27350 and CVE-2023-27351 in PaperCut MF/NG versions 20.1.7, 21.2.11, and 22.0.9 and later.
By April 18, 2023, PaperCut reported evidence of exploitation in the wild against unpatched servers for CVE-2023-27350, also tracked as ZDI-CAN-18987 and PO-1216. CISA added CVE-2023-27350 to its Known Exploited Vulnerabilities catalog on April 21, 2023, with a federal remediation due date of May 12, 2023.
The lesson is not that PaperCut is uniquely bad. The lesson is that internet-facing admin applications become priority targets once a workable exploit path is known. The 2026 Verizon DBIR trend toward vulnerabilities as a leading breach entry point fits the pattern, and the broader risk is covered well in this analysis of vulnerabilities overtaking stolen passwords as an entry point.
There’s a counter-argument: some organizations will say their NG/MF server is “only for printing” and contains no crown jewels. Maybe. But print systems often touch directory services, SAML, SQL Server integrations, badge/card lookup workflows, and privileged admin accounts. That’s enough to justify emergency treatment.
Don’t mix up the May, June, and August fixes
The 2026 PaperCut security record has several moving parts. On May 5, 2026, PaperCut’s bulletin recommended NG/MF 25.0.11 or later for CVE-2026-6180, CVE-2026-6418, and CVE-2026-7824, and said there was no evidence of exploitation for those issues.
In June 2026, PaperCut logged CVE-2026-6645 as resolved in Print Deploy Client v2699, bundled with Print Deploy server 1.10.4178. On August 3, 2026, the vulnerability log listed CVE-2026-8793 and CVE-2026-8794 as resolved in PaperCut NG/MF 26.0.3.
None of that replaces the August 27 emergency bulletin. The PaperCut vulnerability now driving urgent work is the NG/MF pair CVE-2026-82078 and CVE-2026-81578, with Release 3 as the September 1 patch level to verify.
A concrete calculation helps expose false comfort. If your CMDB says you have 18 PaperCut-related assets and only 6 are NG/MF Application Servers, your emergency scope is those 6 first, but if 2 are pre-v24 and 1 is a forgotten disaster-recovery host with a public DNS record, your real risk is not 6 equal boxes. It is 3 high-risk exceptions that need a named owner today.
What to tell leadership and users
Keep the message plain. “We are patching an actively exploited PaperCut NG/MF issue, limiting admin web access, and checking for indicators of compromise” is better than a CVE soup nobody can act on.
Users may notice authentication testing, especially in SAML environments, or temporary restrictions if they previously reached the interface from unmanaged networks. That inconvenience is acceptable. At this risk level, it’s hard to defend broad public access just to avoid a few support tickets.
Security teams should also consider a quick third-party exposure review if PaperCut is hosted by an MSP, print provider, or campus IT unit outside the core security team. Vendor-managed applications still create your incident. For a broader operating model, this guide to vetting third-party vendors for cyber risk is relevant.
After the emergency work, write down the permanent standard: supported NG/MF versions only, no public admin interface without IP restrictions or VPN, logs retained long enough for investigation, and tested rollback plans for authentication regressions. Boring controls age well.
FAQ
What is the latest PaperCut vulnerability in 2026?
The urgent August 2026 issues are CVE-2026-82078, rated CVSS 9.4 Critical, and CVE-2026-81578, rated CVSS 8.8 High. They affect PaperCut NG and PaperCut MF, according to PaperCut’s August 27, 2026 advisory.
Which PaperCut patch should I install now?
Install Emergency Patch Release 3 for PaperCut NG/MF v24, v25, or v26, published September 1, 2026. PaperCut says it supersedes Release 2 and is recommended even for servers already on earlier emergency patches.
Are PaperCut Hive or Mobility Print affected?
PaperCut says Hive, Pocket, Mobility Print, Print Deploy server/client, and User Client are not affected by the August 27, 2026 NG/MF bulletin. Check their separate vulnerability history, but don’t treat them as the affected NG/MF Application Server.
What if my PaperCut NG/MF server is older than v24?
PaperCut advises customers before v24 to upgrade to the latest version. Emergency Patch Release 3 is published for v24, v25, and v26, so unsupported older deployments need upgrade planning rather than a simple emergency patch.
Should I restrict access if I see no suspicious activity?
Yes. PaperCut explicitly instructs admins to restrict public-internet access to NG/MF web interfaces to trusted IP addresses immediately, even where no suspicious activity is observed.
EN 
FR 
ES