PaperCut Issues Second Emergency Patch for Actively Exploited Flaws

What the second emergency patch addresses

After the initial fix released in early June, security researchers discovered that attackers could still bypass the protection in PaperCut NG and PaperCut MF. The company responded with a follow‑up emergency patch that closes the remaining gaps and prevents the known exploitation techniques.

Background on the vulnerabilities

The flaws affect the core web interface that administrators use to manage printers, queues and user permissions. One weakness allowed unauthenticated users to craft specially formatted HTTP requests that could execute arbitrary code on the server. The second issue involved insufficient validation of input parameters, which could be leveraged to gain elevated privileges.

Why the flaws matter to organizations

Print management systems sit at the intersection of network infrastructure and user data. A breach can expose confidential documents, enable lateral movement across the corporate network, and disrupt critical printing services. For enterprises that rely on PaperCut to enforce print policies, the risk is especially high.

Details of the emergency update

The new patch, version 22.0.2, includes the following changes:

• Enhanced validation of all HTTP request parameters to block malformed inputs.
• Strengthened authentication checks for API endpoints that were previously reachable without proper credentials.
• Updated third‑party libraries to the latest secure releases.
• Additional logging to aid incident response teams in detecting attempted exploits.

PaperCut recommends that all customers apply the update immediately. The company provides a detailed installation guide on its official blog, along with a checklist for verifying successful deployment.

How the patch was tested

Before distribution, the security team ran a series of internal penetration tests and engaged external auditors to validate the fix. The tests confirmed that the previously reported bypass techniques no longer work and that the system resists common injection attempts.

Impact on the broader cybersecurity landscape

The rapid release of a second emergency patch underscores the growing pressure on software vendors to respond to zero‑day threats. It also highlights the importance of continuous monitoring for organizations that operate legacy print infrastructure.

Authorities such as the Cybersecurity and Infrastructure Security Agency have issued advisories urging IT teams to verify that the latest PaperCut updates are installed. Failure to do so could leave networks exposed to the same attack vectors that were used in recent high‑profile incidents.

Related vulnerabilities in other products

Similar vulnerabilities have been reported in other print management solutions, prompting a wave of security bulletins across the industry. The National Vulnerability Database now lists multiple CVE entries that reference insecure handling of web requests in printing software.

Microsoft’s Security Response Center has also reminded administrators to apply the latest patches for Windows Print Spooler, a separate but related attack surface.

Steps organizations should take right now

To mitigate risk, security teams can follow this short action plan:

1. Download the 22.0.2 update from the PaperCut support portal.
2. Review the release notes and confirm that the patch addresses both CVE identifiers disclosed in the advisory.
3. Schedule a maintenance window to apply the update across all managed servers.
4. Run post‑deployment tests to ensure that printing functions operate as expected.
5. Enable the new logging features and integrate them with your SIEM solution.
6. Document the patching process and communicate the status to senior management.

Organizations that have already applied the patch report no service interruptions and confirm that the security warnings have disappeared from their dashboards.

Long‑term best practices

Beyond the immediate fix, experts recommend a layered approach to protecting print services:

• Isolate print servers on a dedicated VLAN.
• Enforce strong authentication for administrative access.
• Regularly review audit logs for anomalous activity.
• Maintain an up‑to‑date inventory of all printing devices and associated firmware.
• Participate in vendor security mailing lists to stay informed about future updates.

By combining these measures with timely patch management, enterprises can reduce the attack surface and protect sensitive documents from unauthorized exposure.

The swift response from PaperCut demonstrates a commitment to safeguarding its customers. As the threat landscape evolves, staying vigilant and applying patches promptly remains the most effective defense.