DEV Community

kozhevniko
kozhevniko

Posted on

Print Servers Are Still Domain-Connected Servers: Lessons from the PaperCut Pre-Authentication RCE Chain

#cybersecurity #printinfrastructure #remotecodeexecution #patching

Print Servers Are Still Domain-Connected Servers: Lessons from the PaperCut Pre-Authentication RCE Chain

Print management is one of the few services that every organisation runs and almost none of them treat as security-critical. That assumption is expensive. In August 2026, researchers at Huntress confirmed active exploitation of a chain of two pre-authentication remote code execution flaws in PaperCut NG and PaperCut MF, tracked as CVE-2026-81578 and CVE-2026-82078. CISA added both to its Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 14 September 2026.

Why a print server is a high-value target

PaperCut is not a peripheral utility. To do its job, it integrates with directory services to authenticate users, it runs as a service on a Windows or Linux host, and it frequently holds credentials for the print devices and directory it manages. In many deployments it is domain-joined and reachable from the internal network by every workstation.
That combination is what makes a print server attractive. It is a machine that must accept connections from everywhere, it stores authentication material, and it is rarely included in the same patching and monitoring regime as a web server or a database.

The exploitation picture

The two flaws chain to give an unauthenticated attacker code execution on the PaperCut host. Huntress reproduced the chain before public reporting, and the vendor released fixes for the affected NG and MF branches. Reporting at the time of the KEV addition noted that a large share of internet-reachable instances, roughly 47 percent by one count, were still running version 23 or earlier, which is outside the supported and patched range.
That last figure is the real story. The vulnerability is serious, but the reason it matters is that a substantial population of installations cannot be patched because they are too far behind to have a supported upgrade path.

What defenders should do

Identify every PaperCut installation, including the ones that are not internet-facing. Internal exposure is sufficient for this chain.
Determine the exact version and branch. Version 23 and earlier require a migration, not a patch, and that migration should be planned now rather than during an incident.
Apply the vendor fix for supported versions, and treat the upgrade as urgent rather than routine.
Restrict network access. A print server needs to talk to workstations and printers; it does not need to accept connections from the internet, and it rarely needs unrestricted access from every subnet.
Hunt for evidence of exploitation. Look for unexpected child processes spawned by the PaperCut service, new files in the application's web directories, and outbound connections from the server to addresses it has no business contacting.
Rotate credentials the server holds. If the host was compromised, the directory and device credentials it stores should be considered exposed.

The broader pattern

Print infrastructure, backup servers, and monitoring platforms share a property: they are trusted, they are connected, and they are boring. Boring systems get patched last. Attackers have noticed. The PaperCut chain is the latest reminder that the least glamorous server in the estate is often the one that holds the keys to it.

References

Top comments (0)