Act
active
PaperCut NG/MF zero-day actively exploited in the wild
- Engineer — Act: Zero-day active exploitation in PaperCut NG and MF means no waiting for a patch window; immediately check whether your organization runs either product, apply any vendor-published mitigations or workarounds, and monitor PaperCut’s advisory page for patch availability.
- SOC/IR — Act: Active exploitation of PaperCut servers creates an immediate assume-breach window; hunt for anomalous child-process spawning from PaperCut services, unusual outbound connections from print-management hosts, and review authentication logs on those servers going back at least two weeks.
- Leader — Act: PaperCut NG/MF is broadly deployed in enterprise environments and prior PaperCut vulnerabilities were rapidly weaponized by ransomware actors; confirm with your team this week whether either product is in use and verify that mitigations are being applied before a patch is available.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.