The PaperCut Zero-Day: Why Your Printer Server Can Be a Security Risk
A critical bug in PaperCut's print management software let attackers skip the login screen and run code with full system privileges — and most victims were hit weeks after a fix already existed.
6 min read · Updated September 2, 2026
A critical bug in PaperCut's print management software let attackers skip the login screen and run code with full system privileges — and most victims were hit weeks after a fix already existed.
What PaperCut actually is
PaperCut NG and PaperCut MF are print management platforms used by tens of thousands of organizations — schools, hospitals, government offices, and plenty of small businesses — to track print jobs, enforce quotas, and route printing across a network. It's the kind of software that runs quietly in the background for years, on a server nobody thinks about, doing a job that feels about as far from "security-critical" as IT gets.
That's exactly why the 2023 PaperCut vulnerabilities were such a wake-up call.
What the vulnerability actually let an attacker do
In March 2023, PaperCut patched two vulnerabilities in its Application Server component: CVE-2023-27350, an authentication bypass rated 9.8 out of 10 in severity, and CVE-2023-27351, a lower-severity information-disclosure bug.
The serious one — CVE-2023-27350 — let an attacker reach PaperCut's built-in admin console without ever logging in, by exploiting a flaw in the setup wizard's completion check. Once inside as an unauthenticated "admin," the attacker could use PaperCut's own legitimate "Print Scripting" feature — designed to let real admins run custom code against print jobs — to execute arbitrary commands with SYSTEM-level privileges on the server. No stolen password, no phishing email, no social engineering. Just a crafted web request against a service most networks expose more openly than they realize.
Why it turned into a ransomware on-ramp
PaperCut released patches for the vulnerable versions on March 8, 2023. Proof-of-concept exploit code went public a little over a month later, and mass exploitation started almost immediately. By May 2023, CISA and the FBI issued a joint advisory linking active PaperCut exploitation to the Cl0p and Bl00dy ransomware operations, including a wave of attacks specifically targeting the education sector — school districts and universities, where PaperCut is extremely common and IT teams are often stretched thin.
The pattern was consistent: compromise the PaperCut server, use it as an initial foothold, then move laterally across the network toward full ransomware deployment.
The part that matters more than "zero-day"
It's tempting to file this away as "a zero-day, nothing you could've done." That's not really what happened. PaperCut patched the flaw before proof-of-concept exploit code was public, and organizations had roughly five weeks between the patch's release and the start of mass exploitation to apply it. The organizations that got hit weren't unlucky targets of an unstoppable zero-day — they were running a patch-available vulnerability on an internet-facing server for over a month.
That gap is the actual lesson. A vulnerability only stays a true zero-day for hours or days on a well-run network; the ones that do real damage are almost always sitting unpatched well after a fix exists, on a system nobody's watching closely.
Why "it's just a print server" is the dangerous part
Print servers get treated like a utility, not infrastructure. They rarely show up on anyone's list of critical systems, they're often installed once and left alone, and because they don't handle anything that looks sensitive on paper, they get skipped in patch reviews and left more exposed on the network than a domain controller or file server ever would be.
That's backwards. A print server usually runs with a service account that has real privileges, sits on the same network as everything else, and — as PaperCut proved — can be made to run arbitrary code with SYSTEM access if something goes wrong. The danger was never really about printing. It's about any application server that's easy to forget is even there.
What to actually check
- Inventory every third-party server application on your network — not just the OS. If you can't list what's running and what version, you can't know what's exposed.
- Confirm what's actually reachable from outside your network. PaperCut's admin console was never meant to be internet-facing, and plenty of compromised servers were exposed anyway, whether by design or by accident.
- Patch niche or third-party software on the same cadence as Windows updates — not "whenever someone remembers it exists."
- Segment infrastructure servers (print, backup, monitoring) off the flat network instead of letting them talk to everything.
- Put logging or EDR on servers that don't feel "sensitive." The PaperCut compromises were detectable in server logs well before ransomware deployed — if anyone was watching.
Not sure what's quietly running unpatched on your network? Email info@1-1solutions.com with your user count and current platforms, and we'll tell you honestly what we'd check first.