A critical vulnerability in the print management solution PaperCut NG/MF puts unpatched PaperCut servers running on Windows at risk of being exploited by threat actors. PaperCut is a powerful print management solution for enabling, tracking, managing, and securing an organization’s printing, copying, and scanning needs. Tracked as CVE-2023-39143, the flaw is described by researchers as an unauthenticated remote code execution (RCE) bug stemming from chaining together two (2) path traversal vulnerabilities that exist when the external device integration setting is enabled. The setting is on by default with certain installations of PaperCut, such as the PaperCut NG Commercial version or PaperCut MF. If malicious actors were able to successfully exploit the vulnerability, they could potentially read, delete, and upload arbitrary files to the PaperCut application server. Shodan searches show that at least 1,800 instances of PaperCut servers are exposed to the public internet, and Horizon3 researchers estimate that the majority of them are running on Windows with the external device integration setting toggled on. At this time, there is no evidence that this flaw is being targeted by threat actors for active exploitation. That being said, in April 2023, PaperCut servers were compromised by several ransomware gangs and state-sponsored threat actors like Cl0p, Muddywater, and APT35, exploiting another critical unauthenticated RCE vulnerability (CVE-2023–27350) and an information disclosure bug (CVE-2023–27351). In their report linked below, researchers offer a simple command to help administrators to check if their servers are vulnerable to the exploitation of CVE-2023-39143. The vulnerability has been patched, and CTIX analysts urge all PaperCut administrators to run the command as well as update their servers immediately. If servers cannot be immediately patched due to the negative impact it would have on critical operations, this vulnerability can be manually mitigated by following the PaperCut security best practices guide, configuring an allowlist of device IP addresses who are explicitly authorized to communicate with the PaperCut servers.