PaperCut has issued an urgent warning to customers regarding active exploitation of vulnerabilities in its printer management software, PaperCut NG and MF. The company confirmed that cybercriminals are leveraging these flaws in ongoing attacks, prompting the release of emergency patches.
The identified vulnerabilities are tracked as CVE-2026-82078 and CVE-2026-81578, both carrying high severity scores exceeding 8.8 out of 10. PaperCut stated its security response team is actively investigating the exploitation and is aware of confirmed customer incidents.
PaperCut software is widely deployed across various large organizations, including universities, corporations, and government entities, to manage printers from numerous brands such as Canon, Epson, Xerox, and Brother.
In response to the active exploitation, PaperCut strongly advised customers to remove their servers from public internet access and restrict web interface access to only trusted IP addresses. The company emphasized that these actions should be taken immediately, even in the absence of observed suspicious activity.
The initial discovery and subsequent fix development were aided by information provided by a university customer's security team, which allowed PaperCut to reproduce the vulnerability. An initial patch released by PaperCut was found to be insufficient, leading the company to collaborate with cybersecurity experts from Huntress and watchTwr to develop and release an improved patch on Friday.
Cybersecurity firms, including Huntress, have independently confirmed evidence of exploitation, with Huntress reporting at least two of its customers have been impacted by the campaign targeting these bugs.
Previous vulnerabilities in PaperCut software have been exploited by ransomware gangs and opportunistic attackers to gain initial access to corporate networks. In 2023, U.S. law enforcement agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), issued warnings about ransomware groups like Bl00dy and Clop exploiting PaperCut flaws. CISA specifically highlighted the education sector, particularly K-12 schools, as being highly exposed to these vulnerabilities. Microsoft also reported that an Iranian state-backed group, known for targeting critical infrastructure, exploited a similar bug in 2023.
Experts note that PaperCut installations are attractive targets for attackers due to their internet-facing nature, which can serve as a pivot point into corporate environments. Furthermore, the software can potentially store and allow exfiltration of sensitive printed documents, making it a valuable target for data theft.
