PaperCut NG and MF zero-day under active attack

Print management provider PaperCut has alerted users to an actively exploited zero-day vulnerability affecting all versions of its PaperCut NG and PaperCut MF software. The company confirmed that attackers are leveraging the flaw in the wild before a patch has been released, though specific details about the vulnerability or attack vectors remain undisclosed at this stage.

What happened

PaperCut issued a security notice on 27 August 2026, warning that its NG and MF platforms are being targeted by threat actors. The notice did not specify the number of affected customers, the industries impacted, or the geographic spread of the attacks. No indicators of compromise (IoCs) or mitigation steps beyond standard monitoring advice have been provided publicly. The company stated that a patch is in development but did not indicate when it would be available.

What we don’t know yet

Key details about the vulnerability—such as its severity rating, whether it requires authentication, or how attackers are gaining access—have not been shared. The notice also did not clarify if the attacks are opportunistic or targeted, nor whether any data breaches or lateral movement within networks have been observed. PaperCut has not yet responded to requests for additional information from security researchers or media outlets.