Skip to content
PaperCut NG/MF Vulnerability Under Active Exploitation

PaperCut NG/MF Vulnerability Under Active Exploitation

First seen 27 Aug 2026, 17:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •August 28, 2026 at 16:51 UTC
  • •A zero-day vulnerability in PaperCut NG/MF is actively being exploited.
  • •Emergency patches have been released for versions 25 and 26; version 24 is still pending.
  • •Organizations are urged to restrict public access to their PaperCut servers immediately.

On August 27, 2026, PaperCut issued an urgent advisory regarding a zero-day vulnerability affecting its NG and MF print management software. This flaw allows unauthenticated attackers to execute arbitrary Java code remotely, compromising server configurations. Emergency patches have been released for versions 25 and 26, while version 24 patches are still pending. Organizations are advised to restrict public access to their PaperCut servers immediately. Reports indicate limited exploitation in the wild, with two confirmed incidents noted by Huntress. The vulnerability is currently being actively exploited, and the PaperCut security team is investigating further incidents. Indicators of compromise include suspicious activity from the pc-app.exe process and unusual log file modifications.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 44d ago How this analysis works

Timeline

2023-04-20
CVE-2023-27350 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2023-08-04
CVE-2023-39143 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-27
PaperCut issues urgent security advisory
PaperCut warns of a zero-day vulnerability affecting NG and MF versions, urging immediate action from users.
Huntress
2026-08-27
Emergency patches released
Patches for PaperCut NG and MF versions 25 and 26 are released to mitigate the vulnerability.
BleepingComputer
2026-08-28
Active exploitation confirmed
Huntress reports two instances of exploitation in customer environments, highlighting the urgency of the situation.
Huntress

More articles in this cluster (65)

Following this threat?

Track PaperCut Software and CVE-2023-27350 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 4