PaperCut Zero-Day Exploitation: When Print Management Becomes a Gateway
In August 2026, PaperCut Software issued an urgent security advisory warning of active zero-day exploitation targeting all versions of PaperCut NG and MF print management software. The company confirmed customer incidents involving Internet-exposed servers, with attackers exploiting an undisclosed vulnerability to gain initial access to corporate networks. PaperCut released emergency patches and provided indicators of compromise including suspicious pc-app.exe process activity and modified server.log files with specific database error patterns. The company has a documented history of being targeted by ransomware groups including Clop and LockBit who previously exploited PaperCut vulnerabilities for network access rather than direct document theft. This incident highlights the continued targeting of enterprise print management infrastructure as an attack vector, particularly relevant given the rise of ransomware groups exploiting Internet-facing business applications for initial compromise and the increasing sophistication of zero-day campaigns against widely-deployed enterprise software.
Kill Chain
