60
60
60
57
60
60
45
60
60
PaperCut Zero-Day Under Active Attack: Emergency Patch Released
PaperCut warns that a zero-day in NG and MF print management products is being actively exploited, shipping emergency patches with no CVE assigned yet.
PaperCut Software confirmed active exploitation of a zero-day affecting PaperCut NG and MF, with confirmed customer incidents, and released emergency patches on Friday ahead of technical details or a CVE assignment. The company urges customers to restrict web access to trusted IP addresses, disconnect application servers from the internet, and watch for indicators including tampered or truncated server.log files, database error strings, and suspicious activity involving pc-app.exe. The article recalls the May 2023 exploitation of CVE-2023-27350 and CVE-2023-27351 by the financially motivated Lace Tempest group, a Clop ransomware RaaS affiliate, though no attacker attribution has been given for the current campaign.
76
60
60
60
60
45
60
60
60
45
60
60
Network Attack Trends: February
60
60
60
60
60
Zero-Click WhatsApp Account Takeover Hits iPhone Users Running iOS 16. No Linked Devices, No Warning
60
Week in review: Microsoft fixes exploited Office zero-day, Fortinet patches FortiCloud SSO flaw
60
60
60
Network Security Trends: August
60
60
57
PaperCut NG/MF vulnerabilities exploited in zero-day attacks
PaperCut warns of active zero-day exploitation chaining CVE-2026-81578 and CVE-2026-82078 for pre-auth remote code execution in NG/MF print management.
PaperCut Software confirmed attackers are chaining two vulnerabilities in PaperCut NG and MF: CVE-2026-81578, an improper access control flaw in the web management interface allowing unauthenticated configuration changes, and CVE-2026-82078, unsafe dynamic class loading in database connection utilities enabling arbitrary Java bytecode execution. Huntress reproduced a pre-authentication remote configuration takeover and full RCE chain against PaperCut NG 25.0.11.75758 and observed limited exploitation at two customers, including post-exploitation whoami and ver commands. The vendor released Emergency Patch Release 2 with additional hardening and urged restricting Application Server web access to trusted IPs. In 2023, Clop and LockBit affiliates abused CVE-2023-27350 and CVE-2023-27351 in the same software.
75
60
60
60
60
50
60