Active Exploitation of PaperCut Zero-Day Vulnerability

• •CVE-2026-1001 allows unauthenticated remote code execution in PaperCut NG and MF.
• •Active exploitation was confirmed shortly after the vulnerability's disclosure on August 27, 2026.
• •Patching efforts failed to secure systems, with the first two patches being bypassed.

In late August 2026, a zero-day vulnerability (CVE-2026-1001) in PaperCut NG and MF was exploited in the wild, with attackers actively targeting servers. The vulnerability, which allows unauthenticated remote code execution, was disclosed on August 27, 2026, but no patch was available at that time. The first emergency patch was released on August 28, but it was bypassed the same day. A third patch was issued on September 1, 2026, but the situation highlighted a critical gap in vulnerability response times, with disclosure-to-exploitation times now averaging mere hours. PaperCut's customers faced significant risks, as they had to assess their exposure without effective patches or public exploit code. This incident underscores the urgent need for improved vulnerability management in the cybersecurity landscape.