# CERT-FR Warns of PaperCut Flaws

Published: 2026-10-23 · Severity: routine · Sectors: Technology, Government (National)
Canonical: https://vorant.io/reports/d3c06b11-466c-5df6-9fb5-ac5f5e03fafb/cert-fr-warns-of-papercut-flaws

> CERT-FR advises multiple PaperCut vulnerabilities allow remote code execution, data exposure, and XSS; patches available.

CERT-FR issued an advisory covering multiple vulnerabilities in PaperCut print management products, including PaperCut Hive (versions prior to 2.3.0) and PaperCut NG/MF across the 24.x, 25.x, and 26.0.x branches (prior to 24.1.11, 25.0.13, and 26.0.5 respectively). The vulnerabilities allow an attacker to achieve remote arbitrary code execution, breach data confidentiality, bypass security policies, and conduct indirect remote code injection (XSS).

Four CVEs are referenced (CVE-2026-11744, CVE-2026-14780, CVE-2026-82077, CVE-2026-87739), tied to PaperCut's own September 2026 security bulletin published October 23, 2026. No in-the-wild exploitation is mentioned in this advisory. CERT-FR directs affected organizations to the vendor bulletin for patches.

PaperCut products have historically been high-value targets for ransomware affiliates due to their widespread deployment in enterprise and public-sector printing environments, so defenders running affected versions should prioritize patching given the RCE potential, even absent confirmed exploitation at this time.

## Mentioned in this report

- Vulnerabilities: CVE-2026-11744, CVE-2026-14780, CVE-2026-82077, CVE-2026-87739

## Detection guidance (public sample)

### PaperCut Application Server Spawning Shell or LOLBin Child Process

ATT&CK: T1190

PaperCut's pc-app.exe server process launching a command interpreter or download/exec utility, a typical post-exploitation sign of RCE against PaperCut NG/MF. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PaperCut Application Server Spawning Shell or LOLBin Child Process
description: Detects the PaperCut application server process (pc-app.exe) spawning
  a command interpreter, script host or download/execute utility. The report describes
  RCE in PaperCut NG/MF and Hive but gives no exploit details, so this rule keys on
  the generic post-exploitation parent/child relation. It does not rely on any campaign-specific
  artefact.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \pc-app.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \curl.exe
    - \wmic.exe
  condition: selection
falsepositives:
- Administrators who configured PaperCut external hooks or custom user-sync scripts
  that call cmd.exe or PowerShell
- Vendor-supplied troubleshooting or upgrade scripts launched from the PaperCut server
  process
level: high
id: 56949de6-9ca9-5725-9dc3-0bd6db79a3e1
status: experimental
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1377
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1377

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d3c06b11-466c-5df6-9fb5-ac5f5e03fafb/cert-fr-warns-of-papercut-flaws.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup