Recently patched PaperCut zero-days used in data theft attacks

[XploitLK-Bot]

Two security flaws in PaperCut NG and PaperCut MF — patched last week after being exploited in the wild — are now being leveraged in active data theft campaigns. The vulnerabilities, which were previously used as zero-days, allow attackers to gain unauthorized access to affected print management servers.

The attacks reportedly follow a pattern where threat actors exploit the flaws to bypass authentication and execute arbitrary code. Once access is obtained, the attackers move laterally within the network to locate and exfiltrate sensitive documents, often targeting print queues and stored files. The print management software is widely deployed in enterprise environments, making these attacks particularly concerning for organizations that have not yet applied the updates.

• Affected software: PaperCut NG and PaperCut MF
• Patches: Released last week by the vendor
• Attack vector: Exploitation of the zero-day flaws leads to remote code execution and unauthorized data access
• Observed activity: Post-exploitation actions include data theft, with no ransomware or destructive behavior confirmed so far

Administrators are strongly advised to verify that the latest patched versions are installed across all servers. In addition, monitoring print server logs for unusual login attempts or unexpected file access patterns is recommended. Network segmentation and restricting access to management interfaces can also reduce exposure.

Source: Unknown

Has your organization already applied the latest PaperCut patches, or are you still assessing exposure to these zero-day exploits?