Print management software rarely makes headlines for the right reasons, and PaperCut is back in the spotlight for exactly the wrong ones. Attackers have discovered that two separate vulnerabilities in PaperCut’s widely deployed server software can be chained together to achieve unauthenticated remote code execution — meaning a threat actor with no credentials whatsoever can take complete control of an affected system. The technique, detailed by The Hacker News, represents a serious escalation from either flaw in isolation. For enterprise IT teams still wrestling with unpatched infrastructure, this is the kind of compound exploit that turns a manageable vulnerability into an active incident. If your organization handles device privacy risks across networked hardware, this threat vector deserves immediate attention.
PaperCut NG and PaperCut MF are installed across more than 100 million users in over 70,000 organizations worldwide — universities, hospitals, government agencies, and large enterprises among them. That enormous footprint is precisely what makes this chained exploit so dangerous. The software sits at a privileged intersection of network access and administrative control, managing print quotas, user permissions, and billing data. A successful intrusion doesn’t just compromise a print queue; it hands attackers a foothold inside the broader network.
How the Two-Flaw Chain Actually Works
Neither vulnerability is trivial on its own. The first flaw allows an unauthenticated attacker to interact with a restricted endpoint in PaperCut’s application server, effectively bypassing the login gate under specific conditions. The second vulnerability enables server-side code execution once that initial access is established. Individually, each bug carries a high severity rating. Together, they compose a kill chain that requires zero credentials and can be triggered remotely over the network — a combination that earns the exploit a critical classification under standard CVSS scoring frameworks.
What makes this particularly alarming is the attack’s simplicity once the chain is understood. Researchers note that exploitation does not require advanced tooling or prolonged reconnaissance. An attacker who identifies an exposed PaperCut instance, which is frequently reachable from the internet or accessible through lateral movement inside a corporate network, can move from initial contact to code execution in a short sequence of requests. The exploitation pattern is also likely to be absorbed quickly into automated scanning tools and exploit kits, dramatically broadening the pool of potential attackers beyond sophisticated threat actors.
Patch Now, Audit Later — The Only Acceptable Response
PaperCut has released patches addressing both vulnerabilities, and the company is urging all customers to update immediately. The patched versions close the authentication bypass and the code execution pathway, severing the chain before it can be assembled. Security teams should treat any PaperCut instance running a vulnerable version as actively compromised until patched and audited, not merely as a theoretical risk. That means reviewing server logs for unusual access patterns, checking for new administrator accounts or scheduled tasks, and isolating affected systems from broader network segments where possible.
This episode fits a pattern that should increasingly alarm enterprise security teams: attackers are no longer hunting for single catastrophic flaws. They are investing in vulnerability research that finds how two moderate or high-severity bugs interact, producing a combined effect far more destructive than either flaw’s individual CVSS score suggests. That dynamic makes patch prioritization harder and threat modeling more complex. Organizations relying on managed print environments should also be re-evaluating whether internet-facing exposure of administrative interfaces is necessary at all — a question that applies well beyond PaperCut. The broader lesson, reinforced repeatedly across the security landscape, is that economic pressures on IT staffing and patch cycles are creating exactly the kind of deferred maintenance that exploit chains are designed to exploit.
