The short version: If a copier vendor or a past IT company ever set your North Carolina office up for badge-release or follow-me printing, one of the products that does that job is software called PaperCut, and it can sit on a server in your building for years without anyone on staff thinking about it. In late August it became a path into an entire network that needs no password and no employee clicking anything. Two PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078 (the second rated 9.4 out of 10 for severity), chain together into remote code execution on unpatched print-management servers, per Rapid7. PaperCut disclosed them on August 27, exploitation was already underway, and on August 31 CISA added both to its Known Exploited Vulnerabilities catalog and told federal agencies to patch by September 14, per the CISA alert. The catch for careful shops: PaperCut had to ship the fix three times, so patching once may not have closed it.
Key takeaway: PaperCut shipped the emergency patch, then a hardened Release 2, then a third fix on September 1, because the earlier builds were "not fully protected," per Rapid7. A shop that patched the day the advisory dropped and moved on is now running a build the vendor has superseded. Read the version number off the admin console and confirm it is the current release.
Not sure whether your office even runs an internet-facing PaperCut server, or who patches it? Preferred Data Corporation has kept North Carolina businesses patched and defended since 1987. Call (336) 886-3282 or request a print-server exposure check.
What are the PaperCut NG/MF vulnerabilities under active attack?
They are two chained zero-days in PaperCut NG and PaperCut MF, print-management software that, where a business runs it, sits on a server in the middle of the network. In plain terms: one flaw lets an attacker skip the login screen, and the second lets them run their own commands on the server once they are past it. Together they add up to a full takeover of the box by anyone who can reach it over the network.
For the person who will actually do the patching, here are the specifics. CVE-2026-81578 is an authentication bypass rated CVSS 8.8 (out of 10) that lets an attacker invoke administrative functions without logging in, by abusing Apache Tapestry's request handling. CVE-2026-82078, rated CVSS 9.4, abuses unsafe dynamic class loading in the database-connection code to run arbitrary Java, and through it operating-system commands, per Rapid7. The net effect is unauthenticated remote code execution. No stolen password, no phishing email, nobody on your team clicking anything. If an attacker's scanner can reach the box, that is the whole attack.
The timeline is why this is urgent rather than theoretical:
- August 27, 2026: PaperCut disclosed both flaws and shipped emergency patches; Huntress had already found exploitation in two customer environments, with base64-encoded reconnaissance commands like
whoamiandversitting in PaperCut's own logs, per Help Net Security. - August 31, 2026: CISA added both CVEs to its Known Exploited Vulnerabilities catalog and set a September 14 patch deadline for federal civilian agencies, per the CISA alert.
Quotable definition: A print-management server is the box that meters, releases, and charges back every page your staff prints. To do that job it holds directory service accounts and reaches the workstations that print through it, which is exactly why whoever takes the print server gets a running start at your file server, your workstations, and the directory itself, with the copier the least of it.
Why does a print server deserve emergency-patch treatment?
Because "it is just the print server" is exactly the assumption an attacker is betting your shop makes. PaperCut NG/MF is a full Java web application, reachable on network ports 9191 and 9192, that authenticates against your directory and can run as a Windows service under a domain account with more Active Directory reach than whoever set it up intended. A 40-person distributor in Greensboro or a machine shop near Hickory treats it as invisible office plumbing; an attacker treats it as an unauthenticated foothold it can reach without a login. Huntress found the earliest attacks because the reconnaissance commands were sitting in the server's own logs, unnoticed until someone looked.
The exposure is not niche. The last time PaperCut servers were mass-exploited, in 2023, ransomware crews reached organizations including the education sector within days of disclosure, per Help Net Security. Reporting on the current flaws already describes them being used for data theft, with attackers dumping database tables through the software's bundled database engine, per BleepingComputer. CISA does not add a bug to the Known Exploited list on a hunch; the catalog is evidence of real-world exploitation, per Qualys.
Here is the part your copier vendor will not volunteer: for a 30-person shop in the Piedmont Triad, patching this is the easy part, and only part of the job. A print server has no reason to answer requests from the public internet in a normal setup. If yours does, the patch treadmill is a symptom, and the durable move is getting the server off the open internet for good.
Want a straight answer on whether your PaperCut server is reachable from outside your building? Call Preferred Data Corporation at (336) 886-3282 or explore managed cybersecurity.
Why patching once may not have closed the hole
Because PaperCut shipped the fix three times. The first emergency patch went out on August 27 for supported versions 24, 25, and 26, then the vendor released a hardened Release 2 after further work with outside researchers, and Rapid7 documented a third fix on September 1 because the earlier releases were "not fully protected," per Rapid7. Qualys likewise records that the vendor issued an updated Emergency Patch Release 2 across v24, v25, and v26, per Qualys.
That sequence is a trap for exactly the diligent teams that patched fast. A shop that applied the August 27 build the same day, checked the box, and told the owner it was handled is now running a version the vendor has already superseded twice. So the takeaway here is not about speed. Even a team that patches the hour an advisory drops has to go back a few days later and check whether the vendor quietly shipped a better build, which, this time, they did twice.
| The reflex | Why it falls short | The move that holds |
|---|---|---|
| Patch the server once | PaperCut superseded the first fix twice; one-and-done leaves you on a known-weak build | Confirm the latest release, then re-verify after the advisory settles |
| Trust the firewall | When exposed, the server answers on TCP 9191/9192 from the internet with no auth needed | Restrict the admin interface to internal IP ranges or a VPN |
| Assume it is clean | Exploitation began before disclosure; a patch does not undo a prior breach | Review PaperCut logs for base64 recon and unexpected .class or .cmd files |
| Treat it as office plumbing | The box holds directory service accounts and reaches the workstations that print through it | Segment it and rotate any credentials it can reach |
Key takeaway: On an advisory the vendor re-patched three times, the useful question is which build your server is running this morning, a version number someone can read off the admin console in ten seconds and should.
Have we seen this before with PaperCut?
Yes, and recently enough that it should shape the response. In April 2023, CVE-2023-27350, a 9.8-severity unauthenticated flaw in the same PaperCut software, was mass-exploited within days of disclosure. CISA and the FBI documented the Cl0p and LockBit ransomware gangs using it, and a group calling itself Bl00dy hitting schools, per CISA advisory AA23-131A. The same Cl0p campaign was tied to a known ransomware crew, per Help Net Security.
The pattern from 2023 is repeating on a faster clock in 2026: a critical PaperCut flaw, a working exploit in the wild before the owners running it hear about the flaw, and data-theft crews moving in while the software sits unpatched. This time exploitation was confirmed before the public advisory, and the activity has escalated from probing to active intrusions, per SecurityWeek. Treating a repeat of a 2023 mass-exploitation event as a routine patch is how a small manufacturer in Winston-Salem or Durham ends up spending a quarter cleaning it up.
What should a NC business do this week?
Treat this like the day a machine goes down on the floor, not a work order that waits for the next scheduled visit. Federal agencies got until September 14, and the automated scanners hitting your address never heard that number or care that you run 50 people instead of 5,000. The rest of the list below is for whoever runs your servers, in-house or outsourced, but step one is yours. Work them in order:
- Find out if you run PaperCut at all. Ask whoever manages printing whether PaperCut NG or MF is installed. It is easy to have it and not realize it, because a copier vendor or a prior IT provider can set it up for secure or follow-me printing without it ever crossing your desk.
- Confirm which build is actually running. Because the fix shipped three times for v24, v25, and v26, whoever manages the server should verify it is on the latest emergency release rather than the first one, per Rapid7.
- Get the admin interface off the public internet. If the PaperCut Application Server is reachable from outside, restrict web access to trusted internal IP ranges immediately, per Help Net Security. A print server should not be answering the open internet at all.
- Assume compromise until you check. Have whoever runs the server review PaperCut's logs for the base64-encoded reconnaissance commands Huntress flagged, plus deleted log entries and unexpected
.classor.cmdfiles, the on-disk indicators Qualys documented. - Rotate the accounts the server can reach. The service account PaperCut uses against Active Directory, and any admin credentials on the box, should be rotated if there is any chance of exposure.
Ready to have someone actually own this instead of hoping the copier vendor did? Call (336) 886-3282 or explore managed IT for North Carolina businesses.
What Preferred Data Corporation does for NC businesses on this
PDC has provided managed IT, managed cybersecurity, and network design and segmentation for North Carolina businesses since 1987. For a fast-moving flaw like the PaperCut zero-days, that means three things:
- Emergency patch and version verification. We confirm whether you run PaperCut, apply the current release, and verify the build rather than assuming the first patch held.
- Attack-surface reduction. We check whether the server is exposed to the internet, pull it behind the firewall or a VPN, and segment it away from the machines and directory accounts it should not freely reach.
- Compromise review. We look for the intrusion indicators a patch alone does not remove, because exploitation started before the advisory did.
For a manufacturer, distributor, or contractor across the Piedmont Triad, Greensboro, High Point, Charlotte, or Raleigh, that is the difference between a quiet Tuesday afternoon and a call to your cyber-insurance carrier you would rather not make.
Want your print server handled before the next automated scan finds it? Call (336) 886-3282 or book a security review. Preferred Data Corporation, 1208 Eastchester Drive, Suite 131, High Point, NC 27265.
Straight answers for NC business owners
Do we even have PaperCut if we never bought it?
Possibly. PaperCut NG/MF is the kind of print-management software a copier or managed-print vendor installs to handle secure printing, follow-me printing, and per-department cost recovery, so it can be running on a server in your office without anyone on staff remembering it was set up. The safe move is to ask whoever services your printers and to check for a PaperCut Application Server on your network.
What versions are affected and what is the fix?
PaperCut described all versions of NG and MF prior to the August 27, 2026 advisory as potentially affected, with emergency patches issued for supported versions 24, 25, and 26, per Rapid7. Because the vendor superseded the original patch twice, install the latest emergency release rather than the first one you find.
If our PaperCut server is only on the internal network, are we safe?
You are lower risk, but not clear. The urgent exposure is an Application Server reachable from the public internet, which should be restricted to internal IPs immediately, per Help Net Security. An internal-only server still needs patching, because an attacker who lands anywhere else on your network, through phishing or another flaw, can reach it next.
Does a firewall protect us from this?
Not by itself. If the print server answers on its web ports from the internet, the firewall is passing that traffic to a service that needs no login to exploit. Restricting the ports to internal ranges or a VPN, plus patching to the current release, is what actually reduces the risk.
We already patched on August 27. Are we done?
Check again. Rapid7 documented a third fix on September 1 because the earlier releases were not fully protected, per Rapid7. A same-day patch is exactly the case that now sits on a superseded build, so confirm the current release and review the server for signs of a pre-patch intrusion.
How fast can PDC help if we think we were hit?
Call (336) 886-3282 and tell us you have a suspected active compromise so it is triaged ahead of routine requests. Preferred Data Corporation works on-site across the Piedmont Triad, Greensboro, High Point, Charlotte, and Raleigh within its 200-mile service radius; response times depend on your service plan, and the work starts with containment and a compromise review before the cleanup.
Related Resources
- Managed Cybersecurity for NC Businesses - Emergency patching, attack-surface reduction, and compromise review
- Managed IT Services in North Carolina - Someone who actually owns patching your servers
- Network Design and Segmentation - Keeping a compromised server from reaching everything else
- CISA BOD 26-04 Emergency Patch Deadlines: NC SMB Guide
- When Your Vendor's Server Gets Taken Over: N-able N-central
- Patch Management Speed Saves NC Businesses
- Contact Preferred Data Corporation - Print-server exposure check for NC businesses