PaperCut After Patching
Update, 14 October 2026: PaperCut now lists 26.0.5, 25.0.13 and 24.1.11 as the current maintenance destinations. Version 24.1.11, released on 11 October, backports the fix for CVE-2026-14780. Version 24.1.10 remains the historical fix for CVE-2026-82077 and CVE-2026-87739.
Scripting and Scan2Fax command execution require an authenticated administrator; scripting also needs the optional feature enabled. Report-generation disclosure is unauthenticated. PaperCut has no evidence of exploitation of these September issues.
Install the branch update
| Installed branch | Current maintenance destination |
|---|---|
| 26.x | 26.0.5 |
| 25.x | 25.0.13 |
| 24.x | 24.1.11 |
Keep September and August separate
Release 3 protects against August’s CVE-2026-81578 and CVE-2026-82078 unauthenticated chain and permits normal maintenance. Release 1, Release 2 and unpatched hosts need urgent upgrades.
Application, Site and secondary servers need updating. Mobility Print, Print Deploy and clients are unaffected; unsupported version 23 and earlier need a supported branch.
Preserve evidence before restarting
CISA added both August identifiers to its Known Exploited Vulnerabilities catalogue on 31 August. Huntress observed command execution and attempts to remove log evidence. watchTowr observed the chain in under five seconds and reported an in-memory servlet filter. GreyNoise later reported 395 affected organisations in 48 countries, including domain-administrator access at 12. The Hacker News carried Arctic Wolf reporting on education-sector intrusions and credential searches.
Preserve logs and, where operationally safe, JVM memory before restarting a previously exposed server. Huntress saw log deletion; watchTowr found implants lost on restart. Review the PaperCut service account’s domain privileges. Patching closes vulnerable paths, but does not explain earlier access or invalidate credentials stolen.
Sources
- PaperCut September security bulletin, originally published 24 September 2026 and updated 13 October
- PaperCut urgent security bulletin, initially published 27 August 2026 and updated 10 September
- CISA Known Exploited Vulnerabilities catalogue, both entries added 31 August
- Huntress investigation, published 27 August 2026
- watchTowr analysis, published 9 September 2026 at 14:45 UTC
- GreyNoise campaign analysis, published 9 September 2026
- The Hacker News report carrying Arctic Wolf observations, published 5 September 2026
