Reading a 1.2 Million PaperCut Fingerprint Count Correctly

PaperCut NG and MF are print management platforms deployed on internal networks in schools, hospitals, and enterprises. In September 2026, a chain of flaws in PaperCut was exploited in the wild, with reports describing automated, large-scale use. The interesting part of measuring this exposure is that the raw numbers do not mean what they first appear to mean.

The evidence

ZoomEye searches returned the following at the time of collection:

Query	Count
app="PaperCut"	1,249,245
http.body="PaperCut"	1,285,744
app="PaperCut NG"	0
vul.cve="CVE-2026-81578"	0

Why the large numbers need a caveat

The app="PaperCut" count of 1,249,245 and the http.body="PaperCut" count of 1,285,744 are large, and they should not be read as a count of vulnerable print servers.

There are two reasons. First, an http.body match is a text search across page content. A page that mentions PaperCut, links to PaperCut documentation, or embeds a PaperCut widget will match, even if it is not a PaperCut server. Second, the app="PaperCut" fingerprint is broader than the specific product. It can match deployments and related components that share the fingerprint string.

The app="PaperCut NG" query returned zero, which shows that the more specific product name is not indexed as its own fingerprint in this dataset. That is a coverage limitation, not evidence that no PaperCut NG servers exist.

The vul.cve="CVE-2026-81578" query also returned zero. ZoomEye had no assets indexed against that CVE identifier at collection time. For a flaw disclosed recently, CVE-index coverage is often incomplete.

The vulnerability chain

CVE-2026-81578 is an authentication bypass in PaperCut NG and MF, rated CVSS 9.8. CVE-2026-82078 is a dynamic class loading flaw rated CVSS 9.1. Together they allow an attacker to bypass authentication and achieve remote code execution.

Public proof-of-concept code exists for the pair, and a Metasploit module was proposed. Reports in September 2026 described the chain being used at scale by an automated agent, which is a notable shift in how quickly a public exploit can be operationalized.

What the numbers are good for

The large counts are useful for a different purpose than vulnerability scoping. They show how widely the PaperCut name appears on internet-facing infrastructure, which is a measure of how much of the web is built on or references the platform. That is a deployment footprint question, not a vulnerability question.

For actual scoping, the useful approach is different:

1. Identify PaperCut servers from internal inventory. Print management is usually an internal service, so external search is a weak signal.
2. Check the version against the fixed releases for CVE-2026-81578 and CVE-2026-82078.
3. Restrict network access to the PaperCut server. A print server rarely needs to be reachable from the public internet.
4. If the server was reachable from an untrusted network, treat it as potentially compromised and review for unexpected files or processes.
5. Rotate credentials that the PaperCut server used for directory integration or database access.

The measurement lesson

A large fingerprint count is not automatically a large vulnerability population. The query has to match the thing being measured. http.body="PaperCut" measures how often the string appears in page content. app="PaperCut NG" would measure the specific product, and it returned zero because the index does not carry that fingerprint.

When a count looks implausibly large for the product in question, the right response is to check what the query actually matches, not to report the number as an exposure figure. In this case, the honest statement is that the broad fingerprint is large, the specific product fingerprint is not indexed, and the CVE index has no entries. The reliable scoping has to come from internal inventory.

Limitations

All counts are snapshots with a collection date. Product fingerprint and body-text matches describe presence, not vulnerability. A PaperCut deployment running a fixed build still matches the broad fingerprint, and a page that merely mentions PaperCut also matches the body query.

References

• NVD entries for CVE-2026-81578 and CVE-2026-82078.
• Public proof-of-concept repository for the PaperCut chain.
• Rapid7 Metasploit module proposal for CVE-2026-81578 and CVE-2026-82078.
• ZoomEye asset search, queries executed 19 September 2026.