Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Attackers are exploiting a recently patched security vulnerability in PaperCut NG and MF to execute arbitrary code on vulnerable instances. The flaw allows an unauthenticated attacker to gain remote control over PaperCut's trusted configuration. This control can be used to execute arbitrary Java code within the application. PaperCut has released an emergency fix to address the issue, which includes additional security hardening. The vulnerability is being actively exploited by malicious actors.