There Is No Patch For Version 23

Print management is the least interesting system in most enterprise estates. It also runs with SYSTEM privileges, is joined to the directory, records who printed what, and appears in no board pack. In late August 2026 attackers used it as a way in. The response: two emergency patches in a single day, the first of which did not hold, and a remediation deadline that nearly half of one tracked estate had no way of meeting.

What happened

On 27 August 2026 PaperCut published an urgent bulletin confirming active exploitation against customer servers, with no CVE, no CVSS score and no technical detail while it investigated. Per the vendor's own advisory, it was a university customer's security and incident response teams who supplied the information that let PaperCut reproduce the flaw.

The first emergency patch shipped on 28 August at 02:10 AEST, covering versions 25 and 26 only, and the vendor was explicit that these builds had not gone through its normal release process. The CVEs were assigned later that day. CVE-2026-81578 is a missing authentication weakness in the web management interface, CVSS v4 8.8. CVE-2026-82078 is an unsafe reflection flaw in the database connection utilities, CVSS v4 9.4. Chained, they give pre-authentication remote code execution.

Then the fix broke. watchTowr reproduced the chain, found multiple ways around the first patch and identified a further authentication bypass. Huntress found bypasses of its own. Emergency Patch Release 2 shipped the same day, and is the release that first covered version 24. PaperCut is telling every customer to install it even if they already applied the first one.

The tempo has moved again since. PaperCut extended its indicators of compromise on 30 August, and an exploit module for the chain has been contributed to Metasploit covering the 24.x, 25.x and 26.x branches. On 31 August CISA added both CVEs to the KEV catalogue.

Why this one is different

Most vulnerability briefings ask whether you patched fast enough. This one asks what you do when there is no patch.

Huntress tracks roughly 2,500 PaperCut installations. About 47% ran version 23 or earlier. No fix was available for that branch and the vendor advised upgrading rather than waiting for one. That is not a remediation instruction, it is a procurement one: budget, a supported build, driver and device compatibility testing, and downtime on a system that touches every floor of the building.

The second intrusion Huntress observed hit a PaperCut MF 24.1.5 server, exploited before Release 2 was publicly available. So the estate is not split into patched and unpatched. It is split into patched, patched-but-bypassed, waiting-for-a-patch, and not-getting-one.

The attacker behaviour needs reading carefully, because the first reports understated it. Huntress found exploitation in two environments where activity was limited: one intrusion lasted under two minutes and ran only whoami and ver. It saw no secondary malware or persistence from the payload it recovered.

PaperCut's 30 August update tells a fuller story. Where endpoint protection did not stop execution, the attackers enumerated users and privileges, running processes, domain controllers and logged-on sessions, then pulled a payload from a file sharing host. It silently installs SimpleHelp remote access software set to auto-start, followed by AnyDesk as a redundant second channel.

So the honest reading is two-tier. Where EDR held, this is reconnaissance that stopped inside two minutes. Where it did not, it ends with two independent remote access tools on a server that runs as SYSTEM and is joined to your directory. PaperCut has not attributed the activity and neither will we. For context only: when PaperCut's CVE-2023-27350 was exploited in 2023, the follow-on traffic included Cl0p, LockBit, Iranian state-backed groups and the Bl00dy gang. Different vulnerability, different campaign, but it is what a second wave has looked like before.

The commercial exposure for UK organisations

Regulatory. The Cyber Security and Resilience (Network and Information Systems) Bill reached committee stage in the Lords on 1 September 2026 and has moved on since: UK Parliament records further Lords stages, with the Lords completing their examination of the Bill in October 2026. We have not been able to confirm its precise current stage or whether it has received Royal Assent, so check the Parliament bill page rather than this briefing for its status. It would bring third-party IT products and services into scope of the NIS framework and widen what has to be reported. A print platform sitting unowned between IT operations and facilities is precisely the asset class that regime is designed to catch. Organisations under NIS2 or DORA already owe evidence of control over ICT supply chain risk.

Contractual. The 14 September KEV deadline is a US federal obligation. It is also the date enterprise procurement teams, insurers and auditors will quietly adopt as the reasonable benchmark. If a customer asks whether you were on Release 2 by mid-September and nobody can produce a version number, that is a commercial problem before it is a security one.

Governance. These platforms authenticate against the corporate directory, hold user and card identifiers and log document names, so a compromise is a credible route to personal data as well as to the network. That is ICO territory, not IT housekeeping. And the awkward finding is not technical: a system running at the highest privilege Windows offers, internet-reachable in around a thousand deployments, sat outside the lifecycle management that covers the servers the board actually discusses. Nearly half of a tracked estate does not drift three major versions behind by accident. It drifts because nobody owns it.

What leaders should do this week

1. Confirm the patch level, not the patch status. Ask for the build number. Release 1 was bypassed, so "we patched it" is not an answer.
2. Establish the version. Version 23 and earlier have no fix yet. That decision is an upgrade budget and a date, and it belongs to the executive, not the service desk.
3. Remove the web interface from the public internet today. The vendor recommends this even on fully patched builds.
4. Hunt before you conclude you are clean. Unusual child processes of pc-app.exe, a missing or truncated server.log, the vendor's published log strings, a Windows service named "Remote Access Service" running SimpleService.exe, and any AnyDesk nobody can account for. Absence of indicators is not evidence of absence, and the vendor says so explicitly. If you find compromise, the guidance is to rebuild the Application Server and restore a clean backup, not to clean it in place.
5. Extend scope to site servers and secondary print servers. Print Deploy and Mobility Print are not affected.
6. Ask your managed service provider the same questions. If PaperCut is run for you, the exposure is yours and the evidence is theirs. Get it in writing.

Three questions for the board

1. Which systems run with SYSTEM or root privileges and have no named owner? PaperCut is one answer. The value is in the rest of the list.
2. What is our policy when a vendor fix is later bypassed? Most organisations have a process for applying patches and none for revisiting them.
3. How many production platforms are on an unsupported version, and what would it cost to fix that? If the answer takes more than a week to produce, that is the finding.

The strategic takeaway

Vulnerability management assumes a patch exists. Nearly half of one tracked estate has just discovered that assumption was doing more work than anyone realised. When the remediation is a version upgrade, the constraint stops being the security team's speed and becomes the organisation's willingness to fund lifecycle management for systems that generate no revenue and attract no attention.

That is a board decision, and it is cheaper to make before an incident than during one. The organisations that cleared 14 September comfortably were not the ones with the best detection. They were the ones that could produce a version number for every production platform within the hour.

A system nobody owns cannot be patched on time, because nobody is late.

Garzon Cyber Solutions delivers cybersecurity advisory, compliance certification, and specialist technology recruitment as one integrated capability. We are a young firm, the founder personally runs the work, and our perspective comes from a career spent selling cybersecurity, compliance and technology to security and technology buyers, working alongside marketing and technical colleagues.