Link to the PaperCut Daily Bulletin Board found here. The vulnerability applies to PaperCut NG, PaperCut MF, PaperCut Pocket and PaperCut Hive.
The PaperCut Software security response team is currently investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF, and have released an Emergency Patch – the latest one (Release 3) was issued on Tuesday 1 Sep 2026, 6:22pm (AEST).
The team are aware of confirmed customer incidents and are treating the matter with the highest priority. The PaperCut security bulletin is updated as verified information becomes available, including indicators of compromise and remediation guidance.
Immediate action required
If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses). Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses.
The instruction is:
“Take this action now, even if you have not observed suspicious activity.”
Link to the PaperCut Daily Bulletin Board and Release 3 Patch can be found here.
Emergency Patch Release 3
This is an emergency patch for customers with public-facing PaperCut NG/MF servers who are unable to take other mitigating action.
IT Teams, Administrators and end users do not need to install previous patches, this patch is an accumulation of all emergency releases. The Release 3 Patch addresses two known regressions and adds additional hardening and mitigation against potential attack chains.
Regressions reported include:
- Addresses broken SAML login flows
- Restored support for using legacy Microsoft SQL Server drivers for external card lookup
PaperCut recommend all customers with internet-facing Application Servers install Release 3 as soon as possible, even if they have already applied an earlier emergency release.
For those interested in the “backstory”, PaperCut has released the blog “Behind the scenes – What happened after 9.42 a.m. on Thursday”
