Recently patched PaperCut zero-days used in data theft attacks

Rapid7 confirmed a critical zero‑day in use, while SecurityWeek described the exploitation escalating to active intrusions. The timing coincided with emergency patch releases, signalling an immediate threat to organizations using the software. Following the disclosures, the U.S.

Cybersecurity and Infrastructure Security Agency added the PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog, according to Security Affairs. quasa.io noted that emergency patches are available only for PaperCut versions 25 and 26, leaving earlier releases unprotected. Cybersecurity Dive reported that threat actors are chaining the vulnerabilities to steal data, and BleepingComputer confirmed that the newly patched zero‑days have already been used in data‑theft attacks. At present, organizations running unsupported PaperCut versions remain exposed, while those on 25 or 26 are urged to apply the emergency updates immediately.

Coverage indicates that the inclusion of the flaws in CISA’s catalog may drive broader remediation efforts across the sector. Monitoring for further exploitation attempts is advised as attackers have demonstrated the ability to combine the vulnerabilities for data exfiltration.