PaperCut print management software under active zero-day attack

The Register reports that PaperCut, a widely-used print management platform deployed in schools, universities, healthcare organisations and businesses across the UK, is being actively exploited through a zero-day vulnerability. The flaw allows unauthenticated remote code execution, meaning attackers can take control of PaperCut servers without needing valid credentials. PaperCut has released an unofficial emergency patch, but the company has not yet validated it through its normal quality assurance process. The alternative for organisations is to take PaperCut servers offline until an official patch is available. The vulnerability is being exploited in the wild, and organisations running PaperCut are advised to act immediately.

Why this matters for UK organisations

PaperCut is often deployed on servers that have network access to printers, file shares, Active Directory and other internal systems. A compromised PaperCut server can provide attackers with a foothold inside the network and access to credentials, print logs and potentially sensitive documents that pass through the print queue. The challenge for many organisations is that print management infrastructure is not always treated as a critical system, so it may not be monitored as closely as other servers or included in incident response runbooks. The fact that the emergency patch is unofficial creates a difficult decision for IT teams: deploy an unvalidated fix or take the system offline and disrupt printing services. The operational impact is that organisations must weigh the risk of exploitation against the disruption of taking a business service offline, often without complete information about the scope or severity of the vulnerability.

What to review

Organisations should check immediately whether PaperCut is deployed in their environment and, if so, review the vendor's guidance and decide whether to apply the emergency patch or take the system offline. Consider isolating PaperCut servers from the wider network if they cannot be taken offline, and review logs for signs of suspicious activity or unauthorised access. This is also a prompt to ensure that print management infrastructure is included in your patch management process, that access to PaperCut servers is appropriately restricted, and that you have a plan for responding quickly when zero-day vulnerabilities are disclosed in business-critical software. Review whether PaperCut is included in your security monitoring and whether you have visibility of who is accessing the system and what actions they are performing.

Source: The Register