Print Server Security for SMBs After the PaperCut Zero-Days

Nobody has ever been promoted for securing the print server. That is not a complaint, it is a diagnosis. Print management lives in the same mental bucket as the HVAC controller and the break room coffee machine, the stuff that works until it does not, and when it stops working the ticket goes to whoever sits closest to the copier. Attackers have figured out that this is the most productive bucket in the building. In late August and early September, a pair of chained PaperCut NG and MF flaws (CVE-2026-81578 and CVE-2026-82078) went from first observed exploitation to more than 440 compromised instances across at least 395 organizations in 48 countries, and print server security for SMBs went from a footnote to the most interesting conversation in the room.

This post is not a recap of that advisory. Our ThreatForge write up covered the bug chain itself. The question worth spending two thousand words on is the one that comes after the patch. Why does a print management server hold enough privilege and enough data to be worth chaining two critical bugs together, why is it reachable from the internet so often, and what does a CISSP actually want tested once the emergency builds are in place.

Why print server security is the SMB problem nobody owns

Start with ownership, because that is where the failure begins. Ask a typical fifty to three hundred person company who owns the print environment and you will get three answers. The IT generalist installed PaperCut because the old Windows print queues were a mess. The copier leasing company owns the multifunction devices, the firmware, and a service account they use for remote meter reads. Facilities owns the contract. Security owns none of it, because nobody ever filed print management under security in the first place.

That ownership vacuum shows up in the asset inventory. NIST SP 800-53 control CM-8 asks for an inventory that is accurate, at the right granularity, and includes the information needed to manage the asset. In most SMB environments the print server is listed, but as an infrastructure box with the same priority as a file share for the marketing department. The multifunction printers are usually not listed at all, or they appear as a line in the lease agreement rather than as networked computers running an embedded web server, an SMTP client, an LDAP client, an SMB client, and a hard disk full of scanned documents. Which, for the record, is exactly what they are.

Misclassification is never a cosmetic problem. The category an asset lands in decides its patch priority, its network placement, how long its logs are kept, and whether anybody reviews the accounts it uses. A print server classified as low criticality infrastructure gets patched on the quarterly cycle, sits on the general server VLAN, keeps its logs locally for a week, and runs under a service account that was granted rights in 2019 and never looked at again. Each of those decisions is defensible in isolation. Together they describe a target.

What the PaperCut chain actually handed attackers

The mechanics of the September campaign are worth a paragraph because they show why the print tier is such good real estate. CVE-2026-81578 is an improper access control flaw in the PaperCut web management interface that let an unauthenticated request change system configuration. CVE-2026-82078 lives in the database connection utility, where the application would load a JDBC driver class by name without checking that name against an allowlist. On its own the second bug needed administrator rights. The first bug supplied them. Chained together, an attacker on the far side of a single HTTP request gets arbitrary Java code running inside the PaperCut application server process, which on a typical Windows install runs with SYSTEM level rights on a server that talks to Active Directory all day long.

Huntress observed the first activity on August 26, a day before the vendor advisory, and CISA added both CVEs to the Known Exploited Vulnerabilities catalog on August 31. The early commands were the polite reconnaissance you would expect, base64 wrapped whoami and ver, followed by tasklist. The polite phase did not last.

If any of this sounds familiar, it should. In April 2023, CVE-2023-27350 gave unauthenticated attackers remote code execution on PaperCut servers through a flaw in the setup wizard flow. It landed on the KEV catalog within days, Microsoft attributed exploitation to the Cl0p affiliated group it tracks as Lace Tempest, and CISA and the FBI published joint advisory AA23-131A describing the Bl00dy Ransomware Gang hitting the education sector through the same hole. Two years before that, PrintNightmare (CVE-2021-34527) turned the Windows Print Spooler into a domain wide remote code execution and privilege escalation primitive, serious enough that CISA issued Emergency Directive 21-04 telling federal agencies to disable the spooler on domain controllers outright. Three major print tier incidents in five years is not bad luck. It is a pattern, and patterns are what threat models are supposed to capture.

The print tier is a credential vault with a toner light

Here is the part most SMB risk registers miss. The print server is not valuable because it prints. It is valuable because of what it has to hold in order to print in a modern office.

Secure print release, where a user sends a job and then badges in at any device to collect it, requires the print management server to look up every user and their card number in the directory. That means an LDAP or Active Directory bind account, and in a surprising number of environments that bind account is a member of a group far more powerful than read access requires, because somebody hit a permissions error during the pilot and fixed it the fast way. Quota and cost center tracking requires a database connection, which means another stored credential. Integration with the copier fleet requires administrative credentials for every device, or at least a shared one. Scan to email requires SMTP relay credentials. Scan to folder requires an account with write access to file shares, and that account is very often a domain user with a password that has not changed since the copiers were installed.

Then there is the data. Print management systems keep job logs with document names, user names, page counts, and timestamps, which on their own are a decent map of who works on what. Many deployments retain the job spool, or at least recent jobs held for release, which means actual document content. The multifunction printers carry their own storage, and older units in particular keep images of scanned and copied pages on an internal disk until they are overwritten. In a law office in Plano or a medical billing shop in Frisco, the print tier quietly holds a rolling copy of the most sensitive paper the business produces, plus the credentials needed to reach the rest of it.

Pentesters have a name for one of the easier tricks here, the pass back attack. Most multifunction printers let an administrator configure the LDAP server used for address book lookups, and the embedded web interface ships with a default admin password more often than anybody wants to admit. Point the LDAP server field at an attacker controlled host, click the test button, and the printer helpfully sends its stored bind credentials across the network, frequently in cleartext. The same move works against SMTP and SMB settings on many models. No exploit, no CVE, just a configuration page doing what it was built to do for whoever asks.

The attack path from print console to domain compromise

Walk the path an attacker took through the PaperCut chain and map it to MITRE ATT&CK, because that is how you turn an incident into detection logic. Initial access is T1190, exploitation of a public facing application, against a web console that was published to the internet so a satellite office or a remote campus could check quotas. Execution lands inside the application server process, which on Windows means SYSTEM, so there is no privilege escalation phase to detect. That point deserves to be underlined. A lot of SMB detection tuning watches for the escalation step, and here it simply never happens.

From SYSTEM on the print server, the next stop is T1552, unsecured credentials. The PaperCut configuration holds the database connection string and directory integration settings. Credentials for the copier fleet and the scan to folder account are sitting in configuration files or the database. Local credential material on the server itself is available to anyone running as SYSTEM. Within minutes the attacker holds at least one domain account through T1078 valid accounts, and if the bind account was over privileged, they hold a lot more than one.

Lateral movement from a print server barely registers as an anomaly, because the print server talks to everything as part of its documented job. It reaches every multifunction device over SNMP, HTTP and raw print ports, it queries domain controllers constantly, and it writes to file shares for scan delivery. An attacker moving through T1021 remote services from that box blends into a traffic profile that was already wide and noisy. From there the outcomes in the September campaign followed the familiar split, with some intrusions moving to data theft through T1567 exfiltration over web services and others staging toward ransomware under T1486.

The CISSP takeaway is that the print server is a tier one asset with tier zero adjacency. It is not a domain controller, but it holds credentials and network reach that collapse the distance to one. Any asset that can be compromised without authentication and that hands over directory credentials on arrival belongs in the same risk tier as your VPN concentrator and your remote management tooling, regardless of how boring its job description sounds.

Reachability and inventory controls that change the outcome

Patching is mandatory and nobody needs another paragraph telling them so. PaperCut's September maintenance releases (26.0.5, 25.0.13 and 24.1.10) roll up all three emergency patch releases, and if you are still sitting on an emergency build, the honest answer is that you should be on the maintenance release by the end of this week. CISA Binding Operational Directive 22-01 gives federal agencies a fixed clock for KEV listed flaws, and it is a perfectly good template to borrow for your own SI-2 flaw remediation policy even though nobody is forcing you to.

The control that actually changes the outcome next time is SC-7, boundary protection, applied with some honesty. Pre authentication flaws make the entire IA family of controls decorative. Multifactor authentication on the PaperCut admin console does nothing against code that runs before the login handler is ever reached. The only lever left is whether the attacker can reach the console at all. If remote users need to check balances or release jobs, put the console behind a VPN or a zero trust access broker, not on a public IP. CISA BOD 23-02, which tells agencies to pull networked management interfaces off the internet, is a free and well argued policy document you can adapt for the print tier in an afternoon.

Then fix inventory, because you cannot protect what you have filed in the wrong drawer. Run an external self scan using Shodan or Censys against your own address space and look for PaperCut, embedded printer web servers, and IPP on port 631. Plenty of DFW companies have found a copier at a branch office answering on the public internet because a carrier router was configured with a default port forward. Internally, put every multifunction device into CM-8 as a computer, with a firmware version, an owner, and a patch cadence, and then move the fleet onto a dedicated printer VLAN that can reach the print server and nothing else. Printers have no business initiating connections to domain controllers, workstations, or the internet, and an access control list that says so costs nothing.

AC-6, least privilege, is where the credential vault gets smaller. Audit the directory bind account and strip it to read access on the user attributes print release actually needs. Replace the shared scan to folder account with per destination accounts that can write to one share and nothing else, and rotate those passwords now on the assumption that anything stored on an exposed PaperCut server during the August window is compromised. Change every default device administrator password across the copier fleet, and yes, that includes the one the leasing company asked you not to touch. Disable the Windows Print Spooler on every server that does not print, starting with domain controllers, exactly as ED 21-04 instructed back in 2021.

Detection closes the loop. Forward the print server's Windows event logs and the PaperCut application logs off host under AU-9, to storage the print server's own accounts cannot modify, because an attacker running as SYSTEM will clean up local evidence. Alert on configuration changes in the PaperCut admin interface, on new database connection definitions, and on the PaperCut application server process spawning cmd.exe or powershell.exe, which is a parent and child relationship with no legitimate reason to exist. Watch the bind account for authentication from any host other than the print server. That last one is the single highest signal alert in this whole class of attack, and it takes about ten minutes to build.

How to scope a pentest of the print, scan and email relay path

Here is the uncomfortable truth about most SMB penetration test scopes. The print environment is usually excluded, either explicitly because the copier vendor is nervous or implicitly because nobody thought to list it. That means the asset class with three major exploitation waves in five years is the one asset class nobody has ever tested. A useful print tier assessment answers five questions, and it is worth putting all five in the statement of work by name.

The first question is exposure. From outside, can the tester reach the print management console, any embedded device web server, IPP, or a scan to email relay, including the forgotten branch office copier and the old test instance someone stood up during the migration. The second is version truth, meaning whether the running build on the server and the firmware on each device match what the inventory claims, because emergency patch releases have a habit of being installed on the primary and skipped on the secondary site. The third is credential blast radius. Given a foothold on the print server or a single multifunction device, what credentials can the tester recover, including the pass back attack against LDAP, SMTP and SMB settings, and how far do those credentials reach inside Active Directory. A tester who can walk from a copier's admin page to a domain account with write access to the finance share has just written the most important finding in your report.

The fourth question is segmentation. From the printer VLAN, can the tester reach domain controllers, workstations, or the internet. If the answer is yes, the network diagram is a wish rather than a description. The fifth is detection validation. Run the attack path with the security team watching and record which steps produced an alert, which produced a log entry nobody read, and which produced nothing at all. That coverage map is often worth more than the vulnerability list, because it tells you which of the controls above are real and which only exist in a policy document.

Scope note for the copier vendor conversation. Testing a leased device usually requires the lessor's written permission, and getting it is easier than people expect if you frame it as protecting their equipment from becoming the headline in the next advisory. Put that permission in the rules of engagement before kickoff, not halfway through the assessment.

Print server security is now a tier one conversation

The September PaperCut campaign will fade from the news cycle, and the print tier will drift back into the same bucket as the coffee machine. That drift is the actual vulnerability. Print server security for SMBs is not about the latest CVE pair, it is about recognizing that an unowned, internet reachable application holding directory credentials, file share access, and a rolling archive of scanned documents is a high value asset regardless of how mundane its purpose sounds. Fix the classification, cut the reachability, shrink the credentials, watch the bind account, and then have somebody with intent try to walk the path you think you closed.

That last step is where CyberSphere earns its place. The Penetration Testing module was built for exactly this kind of unglamorous, high consequence scope, letting a team run the external exposure check, the internal print and scan path, and the credential blast radius work out of one dashboard, map each finding to the control it actually violates, and push it into the remediation queue with the evidence attached so the copier vendor, the IT generalist, and the auditor are all reading the same record. If your last pentest quietly skipped the print tier, it is worth a look at https://cybersphere.thecyberone.com/ before the next PaperCut advisory picks the date for you.

Frequently Asked Questions

How quickly does Innovation Network Design respond to a security incident?

Our SOC triages and notifies within 15 minutes with confirmed details and containment steps, rather than handing you a queued alert. Incident response retainer clients carry a 2-hour guaranteed response.

Do you only work with businesses in the Dallas-Fort Worth area?

We are based in McKinney, Texas and work on-site across Plano, Allen, Frisco and the wider DFW metroplex. Our monitoring and response operate remotely, so we also support organizations nationwide.

How do we get started?

Start with a free assessment. Contact us or call 512-518-4408 and we will review your current setup and give you clear, prioritized recommendations before you commit to anything.