PaperCut NG/MF Is Being Exploited — and Versions 23 and Earlier Are Not Getting the Patch
On August 31, 2026, CISA added two PaperCut NG/MF vulnerabilities — CVE-2026-82078 and CVE-2026-81578 — to its Known Exploited Vulnerabilities catalog, with a federal remediation deadline of September 14, 2026. Together they chain into unauthenticated remote code execution against the print-management server that sits in an enormous share of the world's schools, universities, hospitals and offices. PaperCut's urgent security advisory says the attacks have been observed being exploited in the wild, and the company shipped three emergency patch rounds in five days — Emergency Patch Release 3, published September 1, 2026 (AEST), superseded the first two.
Here is the part that turns a patching story into a lifecycle story: Emergency Patch Release 3 shipped for v24, v25 and v26 only. PaperCut's own advisory FAQ asks the question directly — will there be a release for NG/MF 23 and earlier? — and answers: "There are no emergency patches or maintenance releases for version 23 or earlier." To get to a patched build, it says, you need to upgrade to a currently supported version line: 24, 25 or 26. If your print server runs version 23 or anything older, this exploited-in-the-wild chain is not a patch waiting on your backlog. No patch is coming for your branch. The fix is an upgrade, and the federal deadline was September 14.
What the chain lets an attacker do
CVE-2026-81578 (CVSS 8.8, CWE-306: missing authentication for a critical function) is the front door: under specific conditions, unauthenticated remote requests aimed at administrative functions in the web management interface trigger backend actions before access validation completes, letting an attacker modify certain system configurations without ever logging in.
CVE-2026-82078 (CVSS 9.4 Critical on the CVSS 4.0 scale, per PaperCut's bulletin) is what configuration control becomes: the application's database connection utilities instantiate driver classes from configurable driver names without an allowlist, so an attacker who can modify that configuration can make the server load and execute arbitrary Java bytecode on the classpath — code execution under the PaperCut server process itself.
Chained, that is pre-auth remote code execution on the print server. And a print server is a much better prize than it sounds: PaperCut sits in the middle of the network with connectivity to directory services, database credentials in its configuration, and an agent footprint across the fleet. The 2023 exploitation wave against PaperCut servers (CVE-2023-27350) ended in ransomware deployments for exactly this reason — the population that runs PaperCut is heavy on schools, universities and hospitals, and the server touches everything.
Which versions get the fix — and which never will
PaperCut publishes a dated end-of-life calendar. Its End of Life Policy supports the current major version and the two before it (M minus 2), and each time a line drops out it announces two end-of-support dates: an earlier one for customers without current Maintenance & Support (M&S) and a later one for customers with current M&S. We list the later date as the line's end of life. The table below combines that policy with PaperCut's advisory and release history. Version lines and dates are from our tracked PaperCut NG/MF lifecycle data, last checked against PaperCut's pages on 2026-10-09.
| Version line | Status | First release | Support ended, customers without M&S | End of life (customers with M&S) | Last release | Fix for the KEV chain? |
|---|---|---|---|---|---|---|
| 26 | Supported | Jun 30, 2026 | — | — | Latest build Sep 10, 2026 | Yes — latest build |
| 25 | Supported | Aug 12, 2025 | — | — | Latest build Sep 10, 2026 | Yes — latest build |
| 24 | Supported | Aug 1, 2024 | — | — | Latest build Sep 10, 2026 | Yes — latest build |
| 23 | Ending, M&S only | Oct 30, 2023 | Sep 30, 2026 | Dec 31, 2026 | 23.0.9 — May 14, 2024 | None — upgrade to 24, 25 or 26 |
| 22 | End of life | Jun 29, 2022 | Sep 30, 2025 | Dec 31, 2025 | 22.1.5 — Mar 14, 2024 | None |
| 21 | End of life | Apr 13, 2021 | Aug 31, 2024 | Nov 30, 2024 | 21.2.14 — Mar 14, 2024 | None |
| 20 | End of life | Jun 24, 2020 | Dec 31, 2023 | Mar 31, 2024 | 20.1.10 — Mar 14, 2024 | None |
| 19 | End of life | Apr 9, 2019 | Sep 30, 2022 | Dec 31, 2022 | 19.2.7 — May 20, 2022 | None |
Two things in that table deserve emphasis. First, the dates. PaperCut set two end dates for version 23: support ended on September 30, 2026 for customers without current M&S, and it ends on December 31, 2026 for customers with current M&S. Lines 19 through 22 are past both of their dates. Neither date brings a fix for this chain: PaperCut's advisory says there are no emergency patches or maintenance releases for version 23 or earlier, and that the way to a patched build is an upgrade to 24, 25 or 26. Second, the contrast that makes this a decision and not an accident: PaperCut has backported before. The coordinated security release of March 14, 2024 shipped fixes for lines 20, 21 and 22 simultaneously (20.1.10, 21.2.14, 22.1.5). In September 2026, facing active exploitation, the same vendor drew the line at v24. That is the clearest possible statement of where support now ends.
Thirty seconds: which PaperCut are you running?
The version is on the admin console's About page (log in to the PaperCut admin web interface — the version string is displayed there), and in the Application Server logs at startup. The major version is the first number: anything starting 26., 25. or 24. can move to the latest build of its line today from PaperCut's download pages. Anything starting 23. or lower cannot — for those servers, read on.
What to do, by version
On v24, v25 or v26: update to the latest build of your line today. After the three emergency rounds, PaperCut shipped regular maintenance releases for all three lines, and its bulletin now announces them as available. The latest 26 build was released Sep 10, 2026, the latest 25 build Sep 10, 2026, and the latest 24 build Sep 10, 2026. If you applied only Emergency Patch Release 1 or 2, you are not done. This is a KEV-listed, actively exploited chain against a server class that has already been a ransomware entry point once in the last three years; treat it with the same urgency the September 14 federal deadline implies even if no regulator is looking at you.
On v23 or earlier: the fix is an upgrade, and it was always going to be. Three moves, in order of preference:
1. Upgrade to a supported line (24, 25 or 26) — the vendor's stated path. PaperCut's advisory is unambiguous about the destination, and the latest build of each supported line includes the fix. The work is the usual server-application set: check OS and database compatibility for the new line, review integrations (directory sync, payment gateways, embedded copier software), and step through PaperCut's documented upgrade process. It is a bounded project — and a far smaller one than the incident response that follows a compromised print server with directory connectivity.
2. Shrink the route while the upgrade is scheduled. The chain starts at the web management interface. A PaperCut server should never be reachable from the open internet; if yours is, that ends today. Restrict the admin interface to trusted management networks, and watch the application logs for configuration changes nobody made. These are containment measures, not fixes — CISA's required action includes discontinuing use of the product if mitigations are unavailable, and for these lines no patch ships.
3. If print management has moved on, decommission. Print servers are classic leftovers — stood up a decade ago, still running because nothing forced the question. An unpatchable, KEV-listed server that nobody actively manages is pure attack surface. If that describes yours, the fix costs nothing: turn it off.
The full verified entries for both CVEs — affected statements, KEV dates, fixed versions, and sources to CISA, NVD and PaperCut's advisory — are in our Exploited & Unpatchable feed, with a free JSON feed at /exploited-and-unpatchable.json. Every entry is verified against the vendor's own advisory before it goes in; "unpatchable" means the vendor's documentation says so, not that we infer it. We track PaperCut NG/MF and 500+ other products against vendor-verified dates — every PaperCut NG/MF line with live status, or check any version in seconds.
PaperCut NG/MF currently carries an EOL Risk Score™ of 60/100 — Grade C, elevated risk, recalculated at every site build from EOL recency, attack surface, CISA KEV exposure, and extended-support availability. Per-version scores and dates are on the PaperCut NG/MF lifecycle page.
The right response comes down to one question: how many more years does this system need to run? Under a year, extended support (where it exists) is usually cheaper than an emergency migration. One to three years, migrate — support fees paid repeatedly cost more than doing the project once. Indefinitely, migrate now and plan the next one before it surprises you. Extended support is often the more expensive choice over a multi-year horizon — a bridge, not a destination. And if this deadline feels like vendor caprice, it isn’t — why end of life is inevitable for every version, with the receipts.
Frequently Asked Questions
What are CVE-2026-82078 and CVE-2026-81578?
Two vulnerabilities in PaperCut NG/MF print-management servers that chain into unauthenticated remote code execution. CVE-2026-81578 (CVSS 8.8, missing authentication for a critical function) lets unauthenticated remote requests against the web management interface trigger backend actions before access validation completes, modifying certain system configurations. CVE-2026-82078 (CVSS 9.4 Critical, per PaperCut's bulletin on the CVSS 4.0 scale) is unsafe dynamic class loading in the database connection utilities: driver classes are instantiated from configurable driver names without an allowlist, so an attacker who can modify configuration can execute arbitrary Java bytecode under the PaperCut server process. PaperCut says it has observed the attacks being exploited in the wild, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog on August 31, 2026.
Will PaperCut release a patch for NG/MF version 23 or earlier?
No. PaperCut's advisory answers this directly: there are no emergency patches or maintenance releases for version 23 or earlier, and the way to a patched build is an upgrade to a currently supported version line (24, 25 or 26). Emergency Patch Release 3, published September 1, 2026, shipped builds for v24, v25 and v26 only. This is the vendor's declared position, not an inference — and it is notable because PaperCut has backported before: the coordinated March 2024 security release covered lines 20, 21 and 22. For 23 and earlier, the fix is an upgrade, not a patch.
What is the deadline for fixing these vulnerabilities?
CISA added both CVEs to the Known Exploited Vulnerabilities catalog on August 31, 2026, with a remediation due date of September 14, 2026 for US federal civilian agencies. The required action includes applying mitigations per vendor instructions — and discontinuing use of the product if mitigations are unavailable. For a version 23 or earlier server, no patch ships, so the compliant paths are upgrade or discontinue.
Is PaperCut NG/MF version 23 end of life?
PaperCut's End of Life Policy supports the current major version and the two before it, and gives version 23 two end dates. Support ended on September 30, 2026 for customers without current Maintenance & Support (M&S), and it ends on December 31, 2026 for customers with current M&S; our lifecycle entry for PaperCut NG/MF lists that later date as version 23's end of life. Lines 19 through 22 are past both of their dates. Neither date brings a fix for the exploited chain: PaperCut's advisory says there are no emergency patches or maintenance releases for version 23 or earlier, and that the way to a patched build is an upgrade to 24, 25 or 26.
What should I do if I run PaperCut NG/MF 23 or earlier?
Upgrade to a currently supported line (24, 25 or 26) — that is PaperCut's own stated path, and the latest build of each of those lines carries the fix. While the upgrade is scheduled, shrink the route to the web management interface: PaperCut servers should not be reachable from the internet, and the admin interface should be restricted to trusted networks. CISA's required action includes discontinuing use of the product if mitigations are unavailable. If the server is a leftover nobody actively uses, decommissioning it is the cheapest fix of all.
Related
- All PaperCut NG/MF versions with live status — including the end dates PaperCut's End of Life Policy sets for each line
- Exploited & Unpatchable — the verified feed of KEV-listed vulnerabilities that end-of-life versions will never get fixes for, including both entries from this article
- The Roundcube RCE that will never be patched on three version lines — the same mechanic against webmail
- SharePoint's last patch ever fixed a flaw already under attack — when the final fix and the end of support land the same day
- Why End of Life Is Inevitable — the economics behind "fixes ship only in current lines," for every vendor