PaperCut's Zero-Day Needed Two Emergency Patches in One Day. The First One Didn't Actually Fix It.
PaperCut published an urgent security advisory on August 27 confirming active exploitation of a vulnerability chain in PaperCut NG and PaperCut MF, its print management software, and confirmed real customer incidents. The first emergency patch went out August 28 at 02:10 AEST for versions 25 and 26, with version 24 following later the same day. Then researchers found ways to bypass that first fix, and PaperCut had to ship a second emergency patch, on the same day. The same product had a 2023 CVE that ransomware operators, including groups linked to Clop and LockBit, used as an initial-access vector into real victim networks.
PaperCut isn't something most solo web operators run directly. The reason this is worth a full post anyway is what it's a case study in: the gap between "we shipped a patch" and "the patch actually closed the hole" can be measured in hours, and the software most likely to sit in that gap unnoticed is exactly the boring, purchased, infrequently-touched kind that nobody treats as an attack surface until it is one.
The timeline and the technical detail
August 27: PaperCut publishes an advisory stating it's investigating active exploitation and has confirmed customer incidents, treating it as a security emergency rather than a routine disclosure.
August 28, 02:10 AEST: emergency patches ship for PaperCut NG and MF versions 25 and 26. Version 24 gets patched later the same day.
Same day, after the first patch: independent researchers find bypasses for the initial fix, and PaperCut ships a second emergency update to close those gaps.
The vulnerabilities carry CVE-2026-82078 (CVSS 9.4) and CVE-2026-81578 (CVSS 8.8). Chained together, they let an unauthenticated attacker modify system configuration and achieve remote code execution on the PaperCut Application Server without needing valid credentials first. Pre-authentication RCE is close to the worst realistic category for internet-facing software: no phishing required, no credential theft required, just network reachability to a vulnerable instance.
Why the double-patch matters more than the CVSS score
CVSS 9.4 gets attention on its own, but plenty of 9-plus CVEs get one clean patch and the story ends there. This one didn't. Researchers found a way around PaperCut's first emergency fix quickly enough that the company had to ship a second one the same day. That's not a knock on PaperCut's engineers specifically, emergency patches written under active-exploitation pressure are exactly the conditions where incomplete fixes happen. It's a data point about the limits of "we patched it" as a stopping point for anyone deciding whether they're actually safe.
If you or a client were running PaperCut and stopped checking after the first emergency patch landed, you'd have had a false sense of resolution for however many hours passed before the second patch. That gap is the real lesson, independent of whether you've ever heard of PaperCut before this post.
The precedent that makes this worse than a one-off
This isn't PaperCut's first appearance in a ransomware story. CVE-2023-27350, a different vulnerability in the same product line, was broadly exploited in 2023 by multiple threat-actor groups. Microsoft directly linked several of those intrusions to the Clop ransomware operation, which used compromised PaperCut servers as an entry point into larger victim networks, and separately observed intrusions from the same vulnerability class leading to LockBit ransomware deployments.
That history matters because it tells you PaperCut, specifically, is a known and previously-proven initial-access target for ransomware crews who actively hunt for exactly this kind of internet-facing, infrequently-patched enterprise software. A CVSS 9.4 pre-auth RCE in a product with that specific track record isn't hypothetically dangerous, it's the same shape of opportunity that already worked once.
Who this actually applies to
If you're a solo developer building your own SaaS, you likely don't run PaperCut. But if any part of your business involves being the de facto IT person for a few small business clients, which describes a meaningful chunk of freelance developers and small agencies, software exactly like this (print management, ticketing systems, internal line-of-business tools nobody on staff really owns) is common in that world. It's purchased once, configured once, and then left alone because it works and nobody's job is to watch its CVE feed.
What I'd actually do
For every piece of infrequently-touched, purchased software you or a client depends on, whether or not it's PaperCut specifically, know today whether you'd actually hear about an emergency advisory within 24 hours of it shipping, not whenever you next happen to log in and notice a pending update. That means: an actual subscription to the vendor's security advisory feed or mailing list, not a bookmark you might check; a documented owner for who's responsible for applying the patch, even if it's just you; and treating "we already patched" as a question to re-verify against the vendor's own advisory page rather than a box you check once and forget, given that this specific incident proves a patch that gets bypassed hours later is a real, current failure mode and not a hypothetical one.
The honest counter-take
Most solo operators reading this genuinely don't run PaperCut, and the specific CVEs here won't touch their stack. The transferable part isn't the product, it's the pattern: a same-day double-patch on a 9.4 pre-auth RCE, in software with a documented ransomware history, is a reminder that "vendor shipped a fix" and "you're actually safe" aren't the same claim, and the software most likely to catch you off guard is the kind you stopped thinking about the day you finished setting it up.
Author
Lukas
@lukcombinator