On 28 August 2026, PaperCut confirmed a zero-day being actively exploited across all supported versions of its NG and MF print management software. Because PaperCut is widely deployed in schools, universities and businesses, organisations should apply the vendor’s guidance immediately, restrict exposure of the print server, and check for signs of compromise.
What happened
On 28 August 2026, PaperCut alerted customers that attackers are actively exploiting a vulnerability affecting all supported versions of its NG and MF print management software. This is a zero-day, meaning it was being exploited before a fix was widely available, and the fact that all supported versions are affected makes it broad rather than niche.
There is a detail worth pausing on. According to reporting, the exploitation was discovered because a customer’s own forensics team caught the abuse and alerted the vendor, rather than the vendor detecting it independently. That says something important about who was actually watching, and it is a theme worth returning to.
Why print management servers are a target
Print management might sound like an unlikely target, but it is a sensible one from an attacker’s point of view. PaperCut is deployed extremely widely, particularly across education and business, so a single flaw affects a huge number of organisations. The server often sits in a position of trust on the network, and in many deployments it is reachable in ways that give an attacker a useful foothold.
Attackers do not care whether software is glamorous. They care whether it is widespread, reachable and useful as a way in. Print management ticks all three boxes, which is why flaws in it attract rapid exploitation.
What makes this serious
Two things raise the severity here. First, all supported versions are affected, so there is no safe version to have been running. Second, it is being actively exploited as a zero-day, which means the window between disclosure and attack has already closed. This is not a theoretical risk to plan for over the coming weeks. It is a live risk now.
When a widely deployed product has an actively exploited flaw affecting every version, the only safe assumption is that attackers are already scanning for vulnerable instances, including yours.
The detection angle worth noting
The reported detail that a customer’s forensics team, not the vendor, first spotted the abuse deserves attention. It is a reminder that you cannot rely solely on a vendor to tell you when their product is being attacked. Vendors do not have visibility into how their software behaves inside your environment. You do, if you are watching.
This is the difference monitoring makes. An organisation with eyes on its own systems can detect unusual behaviour on a print server, or any server, even when the vendor has issued no warning. An organisation relying on vendors to raise the alarm is depending on someone else noticing first.
Immediate actions
If you run PaperCut NG or MF, treat this as urgent:
- Apply PaperCut’s guidance and any available fix immediately, following the official advisory
- Restrict exposure of the print management server, limiting who and what can reach it, and remove internet exposure where it is not needed
- Review the server for signs of compromise, including unusual activity, unexpected accounts and unfamiliar processes
- Check your monitoring for any anomalies around the affected system
- If you rely on a managed provider, confirm today that your instances are addressed
Speed matters here because exploitation is already happening. The organisations that fare best are the ones that act on the day rather than folding it into a routine patch cycle.
Why monitoring matters when the vendor cannot see in
This incident makes a broader point. The gap between a flaw being exploited and anyone noticing is where damage happens, and that gap is widest for organisations that depend on external warnings. Continuous monitoring closes it by watching for the behaviour exploitation produces, unusual process activity, unexpected connections, signs of a foothold, so an attack is caught early even when no advisory has been issued.
If you want help checking your exposure and watching for exploitation, see our managed detection and response services, or arrange a penetration test to confirm what an attacker could reach.
For the authoritative details, confirm against the official PaperCut security advisory and the CISA Known Exploited Vulnerabilities catalogue.
Frequently asked questions
What is the PaperCut zero-day?
It is a vulnerability in PaperCut NG and MF print management software, confirmed on 28 August 2026 as being actively exploited across all supported versions. Because it was exploited before a widely available fix, and affects every version, it is a broad and urgent risk.
Who is affected?
Any organisation running PaperCut NG or MF, which is common across education and business. Since all supported versions are affected, there is no safe version, so every deployment should be treated as at risk until the vendor’s guidance is applied.
What should I do?
Apply PaperCut’s guidance and any fix immediately, restrict exposure of the print server and remove internet exposure where possible, and review the system for signs of compromise. If a provider manages your instances, confirm today that they have been addressed.
Why does the detection story matter?
The exploitation was reportedly found by a customer’s forensics team, not the vendor, which underlines that you cannot rely on vendors to tell you when their software is attacked. Your own monitoring is what detects unusual behaviour when no advisory has been issued.
