Recently patched PaperCut zero-days used in data theft attacks

Cybersecurity agencies and software providers are responding to a wave of attacks targeting PaperCut NG and PaperCut MF. According to reporting from BleepingComputer, threat actors have utilized recently patched zero-day vulnerabilities to carry out data theft attacks. The situation has escalated to a point where PaperCut has been forced to issue emergency patches to protect its user base from these active threats. These security gaps are being leveraged by attackers to breach systems and exfiltrate sensitive information from affected environments. Coverage from Cybersecurity Dive emphasizes that the attackers are not relying on a single flaw but are instead targeting chained vulnerabilities to achieve their goals. This technique allows threat actors to combine multiple weaknesses to bypass security controls more effectively.

Simultaneously, Security Affairs reports that the Cybersecurity and Infrastructure Security Agency (CISA) in the United States has officially added these PaperCut NG/MF flaws to its Known Exploited Vulnerabilities (KEV) catalog. This action signals that the vulnerabilities are being actively exploited in the wild and requires urgent attention from administrators. This development is critical because PaperCut software is widely used for print management across various organizations. The transition of these flaws from discovered vulnerabilities to entries in the CISA KEV catalog indicates a verified pattern of exploitation. The urgency highlighted by the issuance of emergency patches suggests that the window for attackers to strike before a system is secured is narrow. Organizations utilizing both NG and MF versions of the software are currently at risk if they have not yet implemented the latest security updates provided by the vendor.

Looking forward, the primary focus remains on the widespread adoption of the emergency patches issued by PaperCut. Because CISA has flagged these specific flaws in its catalog, covered entities are now under increased pressure to remediate the vulnerabilities immediately. Future updates will likely depend on whether threat actors evolve their methods of chaining these vulnerabilities or if new flaws are discovered in the wake of the current data theft attacks. Coverage does not yet specify the total number of compromised organizations or the exact nature of the stolen data.