Skip to content

Security Bulletin 27 Aug 2026 Urgent Security Advisory

www.papercut.com • August 28, 2026

PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.

We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing. We will update this security bulletin as verified information becomes available, including indicators of compromise and remediation guidance.

If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses).

Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.

This is an emergency patch for customers with public-facing PaperCut NG/MF servers who are unable to take other mitigating action.

5483518f8c2b6668df2d9135436c66548dc96fbeb5f6f6f809f643a7128b8806

1f8e1eeda1d9c34be6e7d608a2c78e420a85f72112217d8e3759a8d97cdf73e8

9294606825e928d59fb175caf73ccd6ca693d776d645808092f26c964e7cd8dd

530bba5bed0510add6be6d04c4e03759c5dc29d92f536481d1f013915bd837ee

a9a71d111f2233634b91e0e08fe6b6f74a09f69e73ca09df1e9189594d1b1295

2bde20ef100494cba154c38ae39020d5991b469765edb3472e56b5387b82d043

1d15e25718ed21d9aab74cf1fa30510fadb3c065a4444e6fb488a29f83ca1229

7b5d635557c19baa234356f270da32da37c14ba03aac9f32694214e3585862d3

30595f7cb15218187de91547bbdea88eccdcfa37857d6f35e37c035272b82f94

eaae9cfb9fdd774d4260b50e7d4c9de70953f7a87eecc76635994d8913f41742

0782c1d691b485160b498887b0b196bc2a228f51f398b5271b91127c804fc392

f5e8278245b6e73901de23d86032207508d6b6e4720d90406cf218566a63454f

Note: If you use Card/ID number lookups from an external database, review the FAQ below before installing, this patch restricts the SQL queries that feature can use.

This advisory applies to all versions of:

The following may be indicators of compromise:

Alerts from intrusion-detection, endpoint-security, or network-monitoring tools involving the PaperCut Application Server, particularly suspicious post-exploitation activity from pc-app.exe.

Missing, unexpectedly truncated, or deleted PaperCut server.log files.

Any of the following entries in server.log: ERROR No suitable driver found for jdbc:no:x

ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

Important: The absence of the above indicators is not confirmation that a system has not been affected. PaperCut will publish validated, specific indicators and further guidance here as soon as they are available.

Investigation progress

PaperCut’s security emergency response team has used information provided by a university customer’s security team and digital forensics and incident response team. This information has enabled PaperCut to reproduce a vulnerability in the PaperCut NG and PaperCut MF code.

Our emergency engineering team is developing and validating an appropriate code fix.

Emergency patch released

An emergency patch is available for v25 and v26. See download links above and follow the upgrade process .

Q Is this an official release?

No. We have not gone through our usual release process. This is an emergency patch for customers with public-facing PaperCut servers who are unable to take other mitigating action. More information will be published as it becomes available.

Q Will there be a release for NG/MF 24?

Yes, builds are still in progress. We recommend upgrading to the latest version whenever possible.

Q Does this patch affect Card/ID number lookups from an external database?

If you have configured Card/ID number lookups from an external database , you will no longer be able to use SQL queries for this feature that contain EXEC, EXECUTE, or CALL statements in the patched builds.

27 August 2026 (AEST)

Published the initial Security Bulletin.

27 August 2026, 8:00pm (AEST)

Minor wording updates.

27 August 2026, 9:02pm (AEST)

Investigation update posted.

28 August 2026, 02:10am (AEST)

Published emergency patch. Patch released for PaperCut NG/MF v25 and v26.

28 August 2026, 10:43am (AEST)

Additional information added for customers using Card/ID number lookups from an external database.

Category: Security Bulletins

Subcategory: Security and Privacy