CERT-FR Warns of PaperCut Flaws
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
CERT-FR advises multiple PaperCut vulnerabilities allow remote code execution, data exposure, and XSS; patches available.
CERT-FR issued an advisory covering multiple vulnerabilities in PaperCut print management products, including PaperCut Hive (versions prior to 2.3.0) and PaperCut NG/MF across the 24.x, 25.x, and 26.0.x branches (prior to 24.1.11, 25.0.13, and 26.0.5 respectively). The vulnerabilities allow an attacker to achieve remote arbitrary code execution, breach data confidentiality, bypass security policies, and conduct indirect remote code injection (XSS).
Four CVEs are referenced (CVE-2026-11744, CVE-2026-14780, CVE-2026-82077, CVE-2026-87739), tied to PaperCut's own September 2026 security bulletin published October 23, 2026. No in-the-wild exploitation is mentioned in this advisory. CERT-FR directs affected organizations to the vendor bulletin for patches.
PaperCut products have historically been high-value targets for ransomware affiliates due to their widespread deployment in enterprise and public-sector printing environments, so defenders running affected versions should prioritize patching given the RCE potential, even absent confirmed exploitation at this time.
Mentioned in this report
Detection guidance
PaperCut Application Server Spawning Shell or LOLBin Child Process
PaperCut's pc-app.exe server process launching a command interpreter or download/exec utility, a typical post-exploitation sign of RCE against PaperCut NG/MF. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PaperCut Application Server Spawning Shell or LOLBin Child Process
description: Detects the PaperCut application server process (pc-app.exe) spawning
a command interpreter, script host or download/execute utility. The report describes
RCE in PaperCut NG/MF and Hive but gives no exploit details, so this rule keys on
the generic post-exploitation parent/child relation. It does not rely on any campaign-specific
artefact.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \pc-app.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \regsvr32.exe
- \rundll32.exe
- \curl.exe
- \wmic.exe
condition: selection
falsepositives:
- Administrators who configured PaperCut external hooks or custom user-sync scripts
that call cmd.exe or PowerShell
- Vendor-supplied troubleshooting or upgrade scripts launched from the PaperCut server
process
level: high
id: 56949de6-9ca9-5725-9dc3-0bd6db79a3e1
status: experimental
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1377
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1377
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,237 reports from 143 sources, 591 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs