PaperCut NG/MF Is Being Exploited — and Versions 23 and Earlier Are Not Getting the Patch
On August 31, 2026, CISA added two PaperCut NG/MF vulnerabilities — CVE-2026-82078 and CVE-2026-81578 — to its Known Exploited Vulnerabilities catalog, with a federal remediation deadline of September 14, 2026. Together they chain into unauthenticated remote code execution against the print-management server that sits in an enormous share of the world's schools, universities, hospitals and offices. PaperCut's urgent security advisory says the attacks have been observed being exploited in the wild, and the company has now shipped three emergency patch rounds in five days — Emergency Patch Release 3, published September 1, 2026 (AEST), supersedes the first two.
Here is the part that turns a patching story into a lifecycle story: Emergency Patch Release 3 ships for v24, v25 and v26 only. PaperCut's own advisory FAQ asks the question directly — will there be a release for NG/MF 23 and earlier? — and answers that "the recommended path for all customers prior to PaperCut NG/MF v24 is to upgrade to the latest version." If your print server runs version 23 or anything older, this exploited-in-the-wild chain is not a patch waiting on your backlog. No patch is coming for your branch. The fix is an upgrade, and the federal clock runs out September 14.
What the chain lets an attacker do
CVE-2026-81578 (CVSS 8.8, CWE-306: missing authentication for a critical function) is the front door: under specific conditions, unauthenticated remote requests aimed at administrative functions in the web management interface trigger backend actions before access validation completes, letting an attacker modify certain system configurations without ever logging in.
CVE-2026-82078 (CVSS 9.4 Critical on the CVSS 4.0 scale, per PaperCut's bulletin) is what configuration control becomes: the application's database connection utilities instantiate driver classes from configurable driver names without an allowlist, so an attacker who can modify that configuration can make the server load and execute arbitrary Java bytecode on the classpath — code execution under the PaperCut server process itself.
Chained, that is pre-auth remote code execution on the print server. And a print server is a much better prize than it sounds: PaperCut sits in the middle of the network with connectivity to directory services, database credentials in its configuration, and an agent footprint across the fleet. The 2023 exploitation wave against PaperCut servers (CVE-2023-27350) ended in ransomware deployments for exactly this reason — the population that runs PaperCut is heavy on schools, universities and hospitals, and the server touches everything.
Which versions get the fix — and which never will
PaperCut publishes no end-of-life calendar — support rides on Maintenance & Support contracts, and whether an old line gets a fix is decided per release. So the table below reports what PaperCut's advisory and release history actually show. Version lines and dates are from our tracked PaperCut NG/MF lifecycle data, verified September 1, 2026.
| Version line | Status | First release | Last release | Fix for the KEV chain? |
|---|---|---|---|---|
| 26 | Current | Jun 30, 2026 | — | Yes — Emergency Patch Release 3 |
| 25 | Patched | Aug 12, 2025 | — | Yes — Emergency Patch Release 3 |
| 24 | Patched | Aug 1, 2024 | — | Yes — Emergency Patch Release 3 |
| 23 | No further fixes | Oct 30, 2023 | 23.0.9 — May 14, 2024 | Never |
| 22 | No further fixes | Jun 29, 2022 | 22.1.3 — Mar 14, 2024 | Never |
| 21 | No further fixes | Apr 13, 2021 | 21.2.8 — Mar 14, 2024 | Never |
| 20 | No further fixes | Jun 24, 2020 | 20.1.10 — Mar 14, 2024 | Never |
| 19 | No further fixes | Apr 9, 2019 | 19.2.4 — Dec 23, 2020 | Never |
Two things in that table deserve emphasis. First, the wording: we do not say version 23 "is end of life," because PaperCut never declares one — what the record shows is that the vendor declines to patch these branches, in writing, against a chain it says is being exploited. Our lifecycle entry marks lines 19–23 as past support on that de facto basis and explains the provenance. Second, the contrast that makes this a decision and not an accident: PaperCut has backported before. The coordinated security release of March 14, 2024 shipped fixes for lines 20, 21 and 22 simultaneously (20.1.10, 21.2.8, 22.1.3). In September 2026, facing active exploitation, the same vendor drew the line at v24. That is the clearest possible statement of where support now ends.
Thirty seconds: which PaperCut are you running?
The version is on the admin console's About page (log in to the PaperCut admin web interface — the version string is displayed there), and in the Application Server logs at startup. The major version is the first number: anything starting 26., 25. or 24. can take Emergency Patch Release 3 today from PaperCut's download pages. Anything starting 23. or lower cannot — for those servers, read on.
What to do, by version
On v24, v25 or v26: patch today. Emergency Patch Release 3 builds are on PaperCut's download pages for all three lines, and they supersede the two earlier emergency rounds — if you applied Release 1 or 2 last week, you are not done. This is a KEV-listed, actively exploited chain against a server class that has already been a ransomware entry point once in the last three years; treat it with the same urgency the September 14 federal deadline implies even if no regulator is looking at you.
On v23 or earlier: the fix is an upgrade, and it was always going to be. Three moves, in order of preference:
1. Upgrade to the latest version — the vendor's stated path. PaperCut's advisory is unambiguous about the destination, and the current line ships with the emergency hardening included. The work is the usual server-application set: check OS and database compatibility for the new line, review integrations (directory sync, payment gateways, embedded copier software), and step through PaperCut's documented upgrade process. It is a bounded project — and a far smaller one than the incident response that follows a compromised print server with directory connectivity.
2. Shrink the route while the upgrade is scheduled. The chain starts at the web management interface. A PaperCut server should never be reachable from the open internet; if yours is, that ends today. Restrict the admin interface to trusted management networks, and watch the application logs for configuration changes nobody made. These are containment measures, not fixes — CISA's required action includes discontinuing use of the product if mitigations are unavailable, and for these lines no patch ships.
3. If print management has moved on, decommission. Print servers are classic leftovers — stood up a decade ago, still running because nothing forced the question. An unpatchable, KEV-listed server that nobody actively manages is pure attack surface. If that describes yours, the fix costs nothing: turn it off.
The full verified entries for both CVEs — affected statements, KEV dates, fixed versions, and sources to CISA, NVD and PaperCut's advisory — are in our Exploited & Unpatchable feed, with a free JSON feed at /exploited-and-unpatchable.json. Every entry is verified against the vendor's own advisory before it goes in; "unpatchable" means the vendor's documentation says so, not that we infer it. We track PaperCut NG/MF and 480+ other products against vendor-verified dates — every PaperCut NG/MF line with live status, or check any version in seconds.
PaperCut NG/MF currently carries an EOL Risk Score™ of 65/100 — Grade D, high risk, recalculated at every site build from EOL recency, attack surface, CISA KEV exposure, and extended-support availability. Per-version scores and dates are on the PaperCut NG/MF lifecycle page.
The right response comes down to one question: how many more years does this system need to run? Under a year, extended support (where it exists) is usually cheaper than an emergency migration. One to three years, migrate — support fees paid repeatedly cost more than doing the project once. Indefinitely, migrate now and plan the next one before it surprises you. Extended support is often the more expensive choice over a multi-year horizon — a bridge, not a destination. And if this deadline feels like vendor caprice, it isn’t — why end of life is inevitable for every version, with the receipts.
Frequently Asked Questions
What are CVE-2026-82078 and CVE-2026-81578?
Two vulnerabilities in PaperCut NG/MF print-management servers that chain into unauthenticated remote code execution. CVE-2026-81578 (CVSS 8.8, missing authentication for a critical function) lets unauthenticated remote requests against the web management interface trigger backend actions before access validation completes, modifying certain system configurations. CVE-2026-82078 (CVSS 9.4 Critical, per PaperCut's bulletin on the CVSS 4.0 scale) is unsafe dynamic class loading in the database connection utilities: driver classes are instantiated from configurable driver names without an allowlist, so an attacker who can modify configuration can execute arbitrary Java bytecode under the PaperCut server process. PaperCut says it has observed the attacks being exploited in the wild, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog on August 31, 2026.
Will PaperCut release a patch for NG/MF version 23 or earlier?
PaperCut's advisory answers this directly: the recommended path for all customers prior to PaperCut NG/MF v24 is to upgrade to the latest version. Emergency Patch Release 3, published September 1, 2026, ships builds for v24, v25 and v26 only. This is the vendor's declared position, not an inference — and it is notable because PaperCut has backported before: the coordinated March 2024 security release covered lines 20, 21 and 22. For 23 and earlier, the fix is an upgrade, not a patch.
What is the deadline for fixing these vulnerabilities?
CISA added both CVEs to the Known Exploited Vulnerabilities catalog on August 31, 2026, with a remediation due date of September 14, 2026 for US federal civilian agencies. The required action includes applying mitigations per vendor instructions — and discontinuing use of the product if mitigations are unavailable. For a version 23 or earlier server, no patch ships, so the compliant paths are upgrade or discontinue.
Is PaperCut NG/MF version 23 end of life?
PaperCut publishes no end-of-life calendar — support rides on each customer's Maintenance & Support contract, and whether an old line receives a fix is decided release by release. What is documented is the practical effect: the September 2026 advisory's stated path for everything before v24 is upgrade, Emergency Patch Release 3 shipped for v24/v25/v26 only, and no release has shipped for lines 19 through 23 since May 2024. Our lifecycle entry for PaperCut NG/MF marks those lines as past support on that de facto basis — the vendor declines to patch these branches — and explains the provenance on the product page.
What should I do if I run PaperCut NG/MF 23 or earlier?
Upgrade to the latest version — that is PaperCut's own stated path, and Emergency Patch Release 3 builds exist for v24, v25 and v26. While the upgrade is scheduled, shrink the route to the web management interface: PaperCut servers should not be reachable from the internet, and the admin interface should be restricted to trusted networks. CISA's required action includes discontinuing use of the product if mitigations are unavailable. If the server is a leftover nobody actively uses, decommissioning it is the cheapest fix of all.
Related
- All PaperCut NG/MF versions with live status — including how we source de facto support boundaries for a vendor with no EOL calendar
- Exploited & Unpatchable — the verified feed of KEV-listed vulnerabilities that end-of-life versions will never get fixes for, including both entries from this article
- The Roundcube RCE that will never be patched on three version lines — the same mechanic against webmail
- SharePoint's last patch ever fixed a flaw already under attack — when the final fix and the end of support land the same day
- Why End of Life Is Inevitable — the economics behind "fixes ship only in current lines," for every vendor