In the quiet infrastructure of offices worldwide, a trusted piece of software has become an open door. Two vulnerabilities in PaperCut's document and print management platform have been chained together by threat actors, allowing them to enter systems without credentials and take what they find. The patches arrived, but not before the exploitation had already begun — and now CISA's formal designation of these flaws as actively exploited compresses the timeline for every organization still running unpatched versions into something closer to urgency than routine.
PaperCut Zero-Days Exploited in Active Data Theft Attacks
Attackers can move through networks without leaving traditional signs of compromise
Mark
So these are zero-days that PaperCut already patched. What makes them still dangerous if the fix is out?
Mimi
The patch came after attackers had already started using them. That's the critical part. By the time PaperCut released the fix, threat actors were already in active campaigns stealing data.
Luke
Do we know how many organizations have actually been hit, or is that still unclear?
Mimi
The reporting confirms active attacks are happening, but specific victim counts aren't detailed in the available information.
Mark
Why does chaining two vulnerabilities together matter more than just one flaw?
Mimi
One flaw alone might let you do something limited. But chain two together and suddenly you can bypass authentication entirely and run code. That's the difference between a crack in the door and the door swinging open.
Luke
And CISA adding it to their catalog—what does that actually change for organizations?
Mimi
It's a formal government acknowledgment that this is real, active, and urgent. It signals to federal agencies and critical infrastructure that patching is not optional.
Mark
How much time do organizations realistically have before they're at serious risk?
Mimi
If they haven't patched yet, they're already at serious risk. The attacks are happening now.
Luke
The source material doesn't specify which versions of PaperCut are vulnerable beyond NG and MF. Are there other product lines affected?
Mimi
The reporting focuses on NG and MF. Whether other versions are vulnerable isn't addressed in what we have.
El Pulso
- Attackers are actively chaining two PaperCut NG/MF vulnerabilities to bypass authentication entirely and execute arbitrary code on affected servers — no stolen credentials required.
- The exploitation is not theoretical: real-world data theft campaigns are already underway, with sensitive information being extracted from compromised networks before many organizations even knew the flaws existed.
- PaperCut's trusted position inside corporate networks — managing print jobs and document workflows across departments — makes it a particularly dangerous foothold for lateral movement and quiet exfiltration.
- CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog, signaling to federal agencies and critical infrastructure operators that emergency patching is no longer optional.
- The window between patch release and widespread exploitation has already closed — any organization still running unpatched PaperCut is operating in confirmed, active threat territory.
In the quiet infrastructure of offices worldwide, a trusted piece of software has become an open door. Two vulnerabilities in PaperCut's document and print management platform have been chained together by threat actors, allowing them to enter systems without credentials and take what they find. The patches arrived, but not before the exploitation had already begun — and now CISA's formal designation of these flaws as actively exploited compresses the timeline for every organization still running unpatched versions into something closer to urgency than routine.
PaperCut, the document management and print software deployed across thousands of organizations, has become the focus of active exploitation campaigns. Threat actors discovered that two separate vulnerabilities in PaperCut NG and MF could be chained together into a single exploit — one that bypasses authentication entirely and grants attackers the ability to run arbitrary code on affected servers. No compromised account, no phishing lure: the vulnerabilities themselves are the entry point.
Patches were released, but the timeline offered little comfort. Security researchers confirmed that attackers had already weaponized the flaws before fixes were widely applied, using their access to conduct data theft operations against compromised networks. The attack's design is particularly insidious — because it sidesteps traditional authentication, it can leave fewer of the signals that security teams rely on to detect intrusions.
The U.S. Cybersecurity and Infrastructure Security Agency has formally added these flaws to its Known Exploited Vulnerabilities catalog, a designation reserved for threats with confirmed real-world exploitation. For organizations running PaperCut, the message is unambiguous: the patch window has closed, and any system still running vulnerable versions sits exposed to attackers already active in the wild. Given that PaperCut often occupies a trusted position within corporate networks — touching multiple departments and locations — the potential for lateral movement and broad data loss is significant.
PaperCut, the document management and print software used by thousands of organizations worldwide, has become the target of active exploitation campaigns. Threat actors have discovered a way to chain two separate vulnerabilities in PaperCut NG and MF versions together, allowing them to execute code on vulnerable systems without needing valid user credentials. The vulnerabilities were recently patched by the company, but the patches came only after attackers had already begun using the flaws in real-world data theft operations.
The attack method works by combining two distinct weaknesses into a single exploit chain. By stringing these flaws together, attackers can bypass the authentication mechanisms that normally protect the software, gaining the ability to run arbitrary code directly on affected servers. This is a particularly dangerous scenario because it means an attacker does not need to compromise a legitimate user account or trick an employee into opening a malicious file. The vulnerabilities themselves are the entry point.
What makes this situation more urgent is the speed at which the threat landscape has shifted. PaperCut released patches to address these issues, but security researchers and threat intelligence teams quickly confirmed that attackers were already weaponizing the vulnerabilities in active campaigns. The primary objective appears to be data theft—attackers are using their code execution capabilities to extract sensitive information from compromised networks.
The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has formally added these PaperCut NG and MF vulnerabilities to its Known Exploited Vulnerabilities catalog. This designation signals to federal agencies and critical infrastructure operators that these are not theoretical threats but confirmed, actively exploited security flaws. When CISA adds a vulnerability to this list, it typically means the agency has evidence of real-world attacks and is urging organizations to treat patching as an emergency priority rather than a routine maintenance task.
For organizations running PaperCut, the timeline is now compressed. The window between patch release and widespread exploitation has already closed. Any organization that has not yet applied the security updates is operating with known, actively exploited vulnerabilities in their environment. The combination of authentication bypass and code execution capabilities means that attackers can move laterally through a network, access sensitive files, and exfiltrate data without leaving traditional signs of compromise that might trigger alerts. The stakes are particularly high for enterprises that rely on PaperCut for managing print jobs and document workflows across multiple departments or locations, as these systems often sit in trusted positions within corporate networks.
Citas Notables
Threat actors are using the vulnerabilities to execute code without needing valid user credentials— Security researchers and threat intelligence analysis
Quieres la nota completa?
Lee el original en Google News ↗
Technology