Print Servers and Artifact Repositories: Measuring Two Overlooked Attack Surfaces

The PaperCut campaign in August 2026 compromised at least 440 instances across 48 countries using two chained flaws, CVE-2026-81578 and CVE-2026-82078. Around the same period, JFrog Artifactory appeared in CISA's KEV catalog with CVE-2026-82329, an improper authentication issue exploitable in default configurations.

Both targets share a property that makes them easy to overlook. Neither is a web server in the conventional sense, and neither is usually included in the same review cycle as internet-facing applications. ZoomEye data collected on September 19, 2026 shows how much of each population is visible.

Why these two categories matter

PaperCut NG and MF are self-hosted Java applications for print management. On Windows they run with SYSTEM privileges by default and are typically domain-joined with Active Directory integration. That combination means any remote code execution on the host arrives with SYSTEM rights and a domain identity already in hand. The GreyNoise analysis of the campaign documented three post-exploitation paths, all of which depended on that privilege context.

Artifactory is a binary artifact repository. It sits in the software supply chain, holds build artifacts and dependencies, and is accessed by CI systems and developers. An authentication flaw in a default configuration is significant because default configurations are what many deployments actually run.

ZoomEye measurements

ZoomEye queries run on September 19, 2026 returned the following counts.

Query	Matching records
app="PaperCut"	1,249,245
title="PaperCut"	1,251,396
app="JFrog Artifactory"	17,881
app="GitLab"	1,314,452
app="Joomla"	122,045
app="Atlassian Jira"	91,962
app="Confluence"	176,184

The two PaperCut queries return nearly identical totals, which suggests the application fingerprint and the page title are both widely present in indexed records. That consistency is a useful signal that the measurement is stable, but it does not tell you anything about version or about whether the management interface is reachable.

The Artifactory count is an order of magnitude smaller. That is expected for a specialized repository product compared with a widely deployed print management application. Smaller does not mean less consequential. A repository that feeds builds across an organization has a different kind of reach than a print server.

Reading these counts correctly

Three points apply.

The counts measure the indexed population, not the vulnerable population. PaperCut fixed versions are 24.1.10 for the 24.x line, 25.0.13 for 25.x, and 26.0.5 for 26.x. A record matching the PaperCut fingerprint does not indicate which release it runs.

Reachability is separate from presence. The PaperCut campaign's entry condition was a management interface reachable on ports 9191 or 9192. A device in the index may or may not expose those ports publicly.

Adjacent infrastructure matters for context. The GitLab, Jira, and Confluence counts are included because these systems often sit in the same network segment as build and print infrastructure and share the same identity integration. They were not part of the PaperCut campaign and are not implicated by it.

Applying the measurement

For an organization running either product, the practical steps are straightforward.

• Patch PaperCut to 24.1.10, 25.0.13, or 26.0.5 according to the release line. The interval between the August 27 emergency patch and the August 31 start of exploitation was four days.
• Remove public reachability from PaperCut management interfaces on ports 9191 and 9192.
• Do not run PaperCut under a domain administrator service account. One of the three observed post-exploitation paths existed only because that configuration was in place.
• For Artifactory, upgrade immediately and review whether the deployment runs a default configuration.
• Monitor for new accounts added to Domain Admins, DCSync activity, and LSASS access on print servers, since these were the observed post-exploitation behaviors.

Limitations

All counts were collected on September 19, 2026 through ZoomEye and reflect the index at that time. They are population measurements, not vulnerability or exposure determinations. No version-level analysis was performed, and no attempt was made to verify whether ports 9191 or 9192 were publicly reachable on any individual device. The 440-instance and 48-country figures come from GreyNoise reporting on the PaperCut campaign and describe compromised instances, not the total exposed population.

References

• GreyNoise report on the AI-agent-driven PaperCut campaign, September 2026.
• PaperCut security advisories for CVE-2026-81578 and CVE-2026-82078.
• CISA Known Exploited Vulnerabilities Catalog entries for CVE-2026-81578, CVE-2026-82078, and CVE-2026-82329.
• ZoomEye query results collected September 19, 2026.