Key points
- WatchTowr Labs identified a chain of four vulnerabilities enabling unauthenticated remote code execution in PaperCut MF.
- PaperCut assigned three CVE IDs to these issues, bundling vulnerabilities and their respective patch bypasses.
- The flaws include patch bypasses for previously disclosed vulnerabilities, complicating remediation efforts for administrators.
WatchTowr Labs published first-hand research on January 15, 2026, detailing a critical chain of vulnerabilities in PaperCut MF. The research, titled "Death By A Thousand PaperCuts," reveals how attackers can execute code remotely without authentication by chaining multiple flaws together. This discovery highlights significant challenges in securing widely deployed printing management software.
By the numbers
- 4: The total number of vulnerabilities identified by WatchTowr Labs, designated as WT-2026-0141 through WT-2026-0144.
- 3: The number of CVE IDs assigned by PaperCut, which bundle multiple vulnerabilities and patch bypasses into single identifiers.
- 0: The number of authentication credentials required for an attacker to exploit this chained remote code execution path.
What the figures mean
The discrepancy between the four WatchTowr IDs and the three CVE IDs reflects PaperCut’s bundling approach. According to WatchTowr Labs, PaperCut grouped initial vulnerabilities with their subsequent patch bypasses into single CVE entries. This method obscures the true scope of the attack surface. Attackers can exploit these chained flaws to achieve remote code execution, bypassing security controls that were intended to mitigate earlier versions of the vulnerabilities. The complexity arises because fixing one CVE may not address all underlying issues if bypasses remain unpatched.
What should you do?
Managed service providers must audit their PaperCut MF installations immediately. Verify current version numbers against vendor advisories to determine exposure. Monitor network logs for unusual activity originating from printing servers, as unauthenticated exploitation attempts may generate distinct traffic patterns. Ensure that all applied patches are validated, as some may contain bypasses.
Background: Attack surface
An attack surface includes every point where an unauthorized user can try to enter or extract data from your environment. Managing it requires mapping all assets, closing unnecessary ports, and enforcing strict access controls. This process reduces risk by limiting the opportunities attackers have to exploit software flaws or misconfigurations in your network infrastructure.
Read the full guide: Attack Surface Management: 8 Questions Answered for Secure Operations
What to do and how to stay safe: PaperCut
- Review current PaperCut MF software versions against official vendor security advisories to identify exposure.
- Monitor network traffic for unauthorized access attempts to printing management servers.
- Isolate affected systems from critical network segments until comprehensive patching is verified.
- Validate that applied patches fully address both initial vulnerabilities and known bypass techniques.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many vulnerabilities did WatchTowr Labs identify in PaperCut MF?
WatchTowr Labs identified four distinct vulnerabilities, labeled WT-2026-0141 through WT-2026-0144.
Why are there fewer CVE IDs than WatchTowr IDs?
PaperCut bundled multiple vulnerabilities and their patch bypasses into single CVE IDs, resulting in three CVEs for four flaws.
Do these vulnerabilities require authentication to exploit?
No, the chained vulnerabilities allow for unauthenticated remote code execution, meaning no login credentials are needed.
