PaperCut CVE-2026-81578, chained with CVE-2026-82078, is an actively exploited zero-day that gives attackers remote code execution against PaperCut NG and PaperCut MF print management servers, and PaperCut has confirmed real customer incidents. The vendor has shipped an emergency patch for v25 and v26 and says it is treating the matter with the highest priority while an investigation continues. The flaw affects all versions of PaperCut NG and MF, so exposure is broad, and the exploitation is happening now rather than in theory.

Print management servers are an underestimated target because they sit deep in enterprise networks yet often have web interfaces reachable more widely than they should be. History makes the risk concrete: in 2023, PaperCut CVE-2023-27350 (CVSS 9.8) was exploited by Russian threat actors and the financially motivated group Lace Tempest to deliver Cl0p and LockBit ransomware. A fresh, actively exploited RCE in the same product carries the same ransomware-staging potential, which is why PaperCut is urging immediate action even for customers who have seen nothing suspicious.

How do I know if my PaperCut server was compromised?

PaperCut has published indicators of compromise, so hunt before you assume you are clear. Watch for alerts involving the PaperCut Application Server, particularly suspicious post-exploitation activity from pc-app.exe, and for server.log files that are missing, truncated, or deleted. Two specific error strings in server.log are flagged as signals: "No suitable driver found for jdbc:no:x" and "DatabaseUtils - Database error looking up cardID: VALUES CAST."

What should you do right now?

Patch to the fixed v25 or v26 build immediately, and if you cannot patch in the same window, restrict access so the PaperCut server web interfaces cannot be reached from untrusted internet addresses. PaperCut is explicit that customers should apply firewall rules or network access controls now, even without observed suspicious activity, because internet exposure plus active exploitation is the combination attackers are already using.

Our read

An actively exploited RCE in a product with a documented ransomware history is a when-not-if situation, and the 2023 Cl0p and LockBit campaigns against PaperCut are the template. This is the case for continuous verification of the perimeter rather than trust in an asset inventory: the servers most at risk are the internet-reachable ones an organization forgot were internet-reachable. Confirm from the outside which PaperCut interfaces actually answer, apply the emergency patch, and hunt for the published IoCs on the assumption that probing predates your patch.

Reporting by The Hacker News; CVSS and CWE per NVD, exploitation status and IoCs per PaperCut. Sources linked above.

Related: How to prioritize vulnerabilities and Continuous verification vs annual pentest.