Critical

PaperCut NG/MF vulnerabilities exploited in zero-day attacks

Help Net Security

August 27, 2026 at 11:59 AM

Actively Exploited

Overview

PaperCut Software has reported that two vulnerabilities, identified as CVE-2026-82078 and CVE-2026-81578, are being actively exploited in zero-day attacks targeting their print management solutions, PaperCut NG and PaperCut MF. These products are widely used in various organizations, including offices and schools, to manage printing services. The company has confirmed that there have been incidents affecting customers and is prioritizing the response to these vulnerabilities. Given the nature of these exploits, organizations using PaperCut NG or MF should take immediate action to secure their systems, as attackers could potentially gain unauthorized access or disrupt services. The urgency of this situation underscores the importance of staying updated on software vulnerabilities and applying necessary security measures promptly.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: PaperCut NG, PaperCut MF
Action Required: Organizations using PaperCut NG and MF should apply any available patches from PaperCut Software, immediately review their security configurations, and monitor for unusual activity in their print management systems.
Timeline: Newly disclosed

Original Article Summary

Two vulnerabilities (CVE-2026-82078, CVE-2026-81578) affecting print management solutions PaperCut NG and PaperCut MF are being exploited by attackers, PaperCut Software has warned. “We are aware of confirmed customer incidents and are treating this matter with the highest priority,” the vendor said. What is PaperCut NG/MF? PaperCut NG is print management software for places like offices, schools, and other organizations. PaperCut MF (“Multi-Function”) is the upgraded version that works directly with the big all-in-one office copier … More → The post PaperCut NG/MF vulnerabilities exploited in zero-day attacks appeared first on Help Net Security.

Impact

PaperCut NG, PaperCut MF

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations using PaperCut NG and MF should apply any available patches from PaperCut Software, immediately review their security configurations, and monitor for unusual activity in their print management systems. Regular updates and audits of the software should be conducted to mitigate risks from these vulnerabilities.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Zero-day, Vulnerability.

Read Original Article

Related Coverage

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

BleepingComputer

Palo Alto Networks has identified a serious vulnerability in its PAN-OS, labeled CVE-2026-0322, which allows for remote code execution (RCE). This flaw is particularly concerning as it has already been exploited in attacks focusing on their firewall products. Users of Palo Alto's firewalls are at risk, as attackers can potentially gain unauthorized access and control over affected systems. To address this issue, Palo Alto Networks has issued security updates, urging users to apply them promptly to safeguard their networks. This incident highlights the ongoing challenges organizations face in securing their infrastructure against emerging cyber threats.

Oct 14, 2026

Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat

darkreading

A vulnerability has been discovered in the preview pane of Claude Code Desktop, which could allow attackers to steal sensitive credentials from developers without any interaction required. This zero-click flaw poses a significant risk as it can extract SSH private keys, AWS credentials, and Claude OAuth tokens quietly. Developers using this software may unknowingly expose their credentials, leading to potential unauthorized access to their systems and services. This incident raises concerns about the security of development tools and the need for heightened vigilance among users. It's crucial for developers to stay informed about this vulnerability and take necessary precautions to protect their sensitive information.

Oct 14, 2026

FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested

BleepingComputer

The U.S. Department of Justice has taken significant action against the Famous Chollima group, which is linked to North Korean IT workers allegedly engaged in remote schemes. Two individuals were arrested, and 14 others have been charged, with authorities seizing nearly 187 laptops that were reportedly used in these operations. This crackdown is part of broader efforts to combat North Korean cyber activities that threaten U.S. interests and the global cybersecurity landscape. The operation underscores the ongoing challenges posed by state-sponsored cyber activities and the need for vigilance in monitoring such threats. The arrests and seizures may disrupt the group's operations and deter similar activities in the future.

Oct 14, 2026

Ledger asks sellers across Asia to halt sales after supply-chain attack

BleepingComputer

Ledger, a well-known cryptocurrency wallet manufacturer, has initiated a halt on sales of its devices across several Asian countries, including Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. This decision comes amid concerns about potential tampering with the devices in the supply chain. Ledger has reached out to resellers and distributors, urging them to remove affected products from their shelves while the company conducts a thorough investigation. This situation raises significant concerns for users who rely on these wallets for secure cryptocurrency storage, as compromised devices could lead to unauthorized access to their funds. The company’s proactive approach aims to ensure the integrity of its products and protect its customers from possible security risks.

Oct 14, 2026

Cisco patches new Secure Email Gateway zero-day exploited in attacks

BleepingComputer

Cisco has issued a critical patch for a zero-day vulnerability in its Secure Email Gateway (SEG) that has been actively exploited by attackers. This flaw allows remote, unauthenticated users to execute commands with root privileges, posing a significant risk to organizations using the affected software. The vulnerability is particularly concerning as it can lead to unauthorized access and control over email systems, potentially compromising sensitive data. Users of Cisco's SEG are urged to apply the available patches immediately to safeguard their systems against these attacks. The situation emphasizes the need for timely updates and vigilance in protecting email infrastructures from evolving threats.

Oct 14, 2026

U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud

The Hacker News

The U.S. Department of Justice has charged 14 individuals and seized around 187 computers in a crackdown on a North Korean scheme that involved fraudulent remote IT workers. This operation targeted a conspiracy that impacted over 70 U.S. companies, with the accused facing charges related to wire fraud. The defendants include both U.S. citizens and Chinese nationals, highlighting the international dimension of the fraud. By disrupting this scheme, the U.S. aims to prevent North Korea from generating revenue through illegal means, which could potentially support its nuclear weapons program. This case underscores the ongoing challenges posed by state-sponsored cybercrime and the importance of international cooperation in addressing such threats.

Oct 14, 2026