Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

According to reporting from The Hacker News, malicious actors are actively exploiting two vulnerabilities in PaperCut NG and PaperCut MF to execute arbitrary Java code without requiring authentication. The exploitation chain was observed in the wild shortly after PaperCut released an emergency fix on August 28, 2026. The vulnerabilities allow an unauthenticated attacker to gain remote control over the Print server's trusted configuration, potentially leading to full system compromise. PaperCut has released version 23.01 and later for NG and version 20.1.2 and later for MF, which include the fix and additional hardening measures. Users are strongly advised to update to the patched versions immediately to mitigate the risk of exploitation. The exact technical details of the vulnerability chain are pending full advisory release, but the impact is assessed as severe, with potential for data exfiltration, lateral movement, and ransomware deployment.