PaperCut Under Attack: Print Servers Are the New Front Door for Ransomware Crews

Your print server is the least-protected box on the network. Attackers just proved it.

PaperCut NG/MF, the print management software running in the server rooms of schools, councils, and banks across Africa, is under active exploitation. Two flaws, chained together, let an unauthenticated attacker walk in through the front door and run code on the host. There are no credentials to steal and no phishing email for someone to click.

CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on Monday, and US federal agencies have until September 14 to remediate. The rest of us should treat that deadline as advice, not a suggestion.

The two flaws and how they chain

The vulnerabilities are tracked as CVE-2026-82078 and CVE-2026-81578. Together they do two things: bypass authentication, then achieve remote code execution on the affected PaperCut instance. PaperCut confirmed active exploitation on August 27 and shipped an emergency patch quickly. Too quickly, as it turned out, because attackers found a way around the first fix, forcing a second emergency patch within days. An official release covering both issues is still in the works.

That patch-and-bypass cycle should worry any security team. The exploit is being refined in the wild, in real time, by people who care more about getting in than staying quiet.

What attackers are doing inside

WatchTowr, which has been tracking the exploitation, says the activity moved from scanning to full intrusion faster than expected. “We are no longer seeing purely exploratory probes to identify vulnerable systems, but real-world exploitation accompanied with hands-on-keyboard interaction from human attackers exploring systems they’ve compromised,” said Jake Knott, the firm’s head of threat intelligence.

Some of that hands-on work has a specific goal: pivoting. Knott notes the attackers built access paths “purely to facilitate external to internal network pivoting”, and they keyed their in-memory payloads so only they could use them. That’s the signature of initial access brokers, the crews that break into networks and sell the foothold to ransomware groups.

PaperCut’s updated indicators of compromise show remote access tools being planted on targeted systems. Roughly 1,000 PaperCut NG/MF instances are exposed to the internet according to ShadowServer, and in many organizations the print server is one of very few boxes with broad network reach that nobody thinks to segment.

What African enterprises should do this week

• Patch now, but don’t stop at patching. If your PaperCut instance was internet-facing and unpatched at any point in the last week, assume it’s compromised. Knott’s warning is blunt: patching alone locks out new attackers while existing ones keep their access.
• Trigger incident response. Hunt for the published IoCs, look for unexpected RAT binaries, new local accounts, and outbound connections from the print server that have no business existing.
• Check exposure. Query your asset inventory for any PaperCut admin interface reachable from the internet. If one shows up, that’s your first containment priority.
• Segment the print server. It should not be able to talk to domain controllers, file shares, or payment systems. If it can today, fix the routing this week.

Why a print-server CVE is worse than it looks

Print management servers are boring infrastructure, and boring is where budgets don’t go. They run with service-level privileges, they hold queues full of scanned documents (IDs, bank statements, medical records), and they usually sit flat on the LAN. An authentication bypass on a box like that is a worse position than a foothold on a workstation, and it cost the attacker nothing but a single HTTP request.

eHawu’s network-layer controls exist for exactly this class of problem. When a print server suddenly opens a persistent outbound channel to an unknown host, or starts accepting connections it never made before, that’s a routing-level anomaly the eHawu gateway sees and can cut, regardless of whether anyone remembers to patch the box underneath. PaperCut’s vendors have shipped two emergency fixes in five days; your network posture shouldn’t depend on that kind of scramble.