On September 10, 2026, PaperCut published NG/MF versions 26.0.5, 25.0.13, and 24.1.10, replacing three emergency patches and closing two actively exploited flaws, CVE-2026-81578 and CVE-2026-82078. If you are still running an emergency patch, move to the maintenance release now.

On August 27, 2026, PaperCut confirmed active exploitation of two zero-days in its NG and MF print management products, chained into unauthenticated code execution. The first emergency patch was already bypassed: apply the second version and cut internet access.