Two PaperCut zero-days chain into unauthenticated code execution and land on the KEV catalog

On August 27, 2026, PaperCut confirmed active exploitation of two zero-days in its NG and MF print management products, chained into unauthenticated code execution. The first emergency patch was already bypassed: apply the second version and cut internet access.