The attacks reportedly follow a pattern where threat actors exploit the flaws to bypass authentication and execute arbitrary code. Once access is obtained, the attackers move laterally within the network to locate and exfiltrate sensitive documents, often targeting print queues and stored files. The print management software is widely deployed in enterprise environments, making these attacks particularly concerning for organizations that have not yet applied the updates.

• Affected software: PaperCut NG and PaperCut MF
• Patches: Released last week by the vendor
• Attack vector: Exploitation of the zero-day flaws leads to remote code execution and unauthorized data access
• Observed activity: Post-exploitation actions include data theft, with no ransomware or destructive behavior confirmed so far

Administrators are strongly advised to verify that the latest patched versions are installed across all servers. In addition, monitoring print server logs for unusual login attempts or unexpected file access patterns is recommended. Network segmentation and restricting access to management interfaces can also reduce exposure.

Source: Unknown

Has your organization already applied the latest PaperCut patches, or are you still assessing exposure to these zero-day exploits?