PaperCut warns of NG, MF flaw exploited in zero-day attacks
PaperCut warns of zero-day attacks exploiting a flaw in its NG and MF print management software.
Run PaperCut?
Get an email when a reviewed story names PaperCut, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
PaperCut is alerting customers to active zero-day exploitation of a vulnerability affecting all versions of its PaperCut NG and PaperCut MF print management software. The company has released emergency patches and advises restricting web interface access to trusted IPs. Indicators of compromise include suspicious activity from pc-app.exe and modified server.log files.
The lesson from this incident
Full lessonA critical zero-day vulnerability in PaperCut NG and MF print management software was actively exploited before many organizations could respond, highlighting the danger of internet-exposed administrative interfaces on widely deployed enterprise software. The root issue lies in insufficient access restrictions on the web management interface combined with a software flaw that attackers weaponized immediately upon discovery. Because print management software is often deprioritized in security programs, organizations frequently lack rapid patching workflows for such tools. This incident underscores that any internet-facing or network-accessible management interface — regardless of the application's perceived criticality — represents a viable attack surface that adversaries will target.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Next-generation firewall and intrusion prevention
Malicious traffic is blocked at the network edge and between zones.
Indicators of Compromise
- malware — pc-app.exe