PaperCut NG/MF Zero-Day Exploited on Internet-Exposed Servers

PaperCut has confirmed active exploitation of an undisclosed zero-day affecting all versions of its PaperCut NG and MF print-management products. The attacks target publicly accessible PaperCut Application Servers, and the vendor has reported customer incidents but has not disclosed the flaw’s technical details, attacker attribution, post-compromise actions, or whether data was stolen.

PaperCut released emergency patches for public-facing Application Servers and urged customers to immediately restrict the web interface to trusted IP addresses using firewall or network controls. Administrators should investigate alerts involving suspicious pc-app.exe activity, altered or missing server.log files, and anomalous log errors; however, PaperCut cautioned that the absence of these indicators does not confirm a system is uncompromised. The incident follows prior ransomware and state-linked exploitation of PaperCut flaws, including CVE-2023-27350 and CVE-2023-27351.