Loading story…
Germany's dCERT issued advisories for multiple vulnerabilities in CUPS, the Common UNIX Printing System used across Linux and Unix-like environments. The notices indicate that flaws were identified in the printing stack that could be abused to disrupt service availability, affecting systems that rely on CUPS for print management and related network printing functions.
A follow-up advisory specified that the CUPS vulnerabilities can allow denial-of-service conditions, raising the risk of printer service crashes or broader printing outages on exposed hosts. Organizations using CUPS should review vendor guidance, identify affected packages and versions, and prioritize patching or other mitigations to reduce the likelihood of service disruption.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
dCERT published advisory 2026-0975 stating that multiple CUPS vulnerabilities allow denial-of-service conditions. This represents a later advisory update or additional disclosure focused on impact.
dCERT issued advisory 2026-0927 covering multiple vulnerabilities affecting CUPS. The notice marks the public disclosure of the vulnerability set by dCERT.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in the Common Unix Printing System (**CUPS**) were publicly disclosed, including flaws that can be chained into **remote code execution** on affected Linux and Unix systems. Reporting described the issue as a critical CUPS-based RCE risk, while an `oss-security` disclosure listed multiple **CVEs** tied to the print server and related components, expanding the scope from a single bug to a broader set of weaknesses in widely deployed printing infrastructure. Subsequent coverage said AI agents were able to identify vulnerabilities in the same Linux and Unix print server stack, underscoring how quickly offensive research techniques can surface exploitable flaws in foundational services. Because CUPS is commonly enabled across enterprise and workstation environments, the disclosures raised concern that exposed or reachable print services could provide attackers with a path to execute code remotely, making patching, service exposure review, and printer-related attack surface reduction urgent priorities.
Jul 12, 2026
Researchers disclosed a high-impact vulnerability chain in **OpenPrinting CUPS** affecting version `2.4.16` and earlier that can let an unauthenticated remote attacker progress from network-reachable print-job submission to **code execution as `lp`** and then to a **root-level file overwrite**. The chain combines `CVE-2026-34980`, which abuses anonymous `Print-Job` requests against a shared PostScript queue, with `CVE-2026-34990`, an authorization flaw that lets a local unprivileged user coerce `cupsd` into authenticating to an attacker-controlled localhost IPP service and reuse a print admin token to overwrite root-owned files. Public advisories and proof-of-concept details were released by researcher Asim Viladi Oglu Manizada and OpenPrinting, and fixes were committed publicly even though no patched release was yet available. Defenders were urged to reduce exposure immediately because exploitation depends on reachable `cupsd` services, legacy shared queues, and permissive submission behavior rather than user interaction. Recommended mitigations include disabling or restricting network exposure of CUPS, requiring authentication for shared queue submissions, disabling shared legacy queues where possible, and confining the service with **SELinux** or **AppArmor**. Follow-on discussion noted that removing CUPS outright may be impractical on some Ubuntu systems because `cupsd` is commonly installed by default and intertwined with other packages, making service isolation and firewalling more realistic short-term controls.
Jun 29, 2026
A critical vulnerability in Apache Tomcat, identified as CVE-2025-48989, allows remote, unauthenticated attackers to degrade HTTP/2 service performance, potentially leading to a denial-of-service (DoS) condition. The flaw, caused by improper resource shutdown or release, affects Tomcat versions 11.0.0-M1 through 11.0.9, 10.1.0-M1 through 10.1.43, and 9.0.0.M1 through 9.0.107, with patches available in subsequent releases. F5 has confirmed that while some of its products use vulnerable Tomcat versions, not all are affected due to lack of HTTP/2 support. Organizations are advised to upgrade to the fixed versions to mitigate risk. Separately, a use-after-free vulnerability in CUPS (CVE-2023-34241) impacts versions from 2.0.0 up to but not including 2.4.6, potentially allowing attackers to corrupt data, cause DoS, or execute unauthorized code. The issue arises from improper memory handling during logging operations after a connection is closed. Additionally, research has highlighted a severe vulnerability (CVE-2024-12649, CVSS 9.8) in Canon printers, where attackers can execute malicious code simply by sending a specially crafted XPS file containing a malicious TrueType Font (TTF). These vulnerabilities underscore the increasing focus of attackers on networked devices like printers and print services, which often lack robust endpoint protection and can serve as entry points into organizational networks.
Jun 29, 2026