How to apply PaperCut emergency Update for vulnerability

PaperCut is a widely used print management solution in many organizations. Recently, a critical vulnerability was identified affecting PaperCut MF and NG servers, particularly relating to external card lookup functionality. This guide outlines best practices for addressing the latest vulnerability, including how to update your system and where to find further support.

Understanding the Latest PaperCut Vulnerability

(Official PaperCut MF Release - Sept, 10th, 2026)

Official Versions now released and available for download. ***IMPORTANT*** PaperCut has moved all external card lookup configurations to the security.properties files now.

Best Practices for Addressing the Vulnerability

Review Official PaperCut Advisories

Visit the Aug 2026 urgent security advisory overview page for details about the vulnerability, affected versions, and recommended actions.

Update PaperCut to the Latest Version

From the previous article, ensure you install the latest supported version of PaperCut MF. Updates often include critical security patches. Follow the official instructions on the PaperCut Update Manual to perform the upgrade.

Step 1: Confirm Important Steps for Upgrading to PaperCut v25 or Higher

Review the following article when upgrading from anything older than PaperCut v25. There are additional steps required.

Important steps for upgrading to PaperCut v25.X or higher

NOTE: Make sure PaperCut is not using any legacy SQL Drivers, as described in the article above.

Step 2: Confirm and Update External Card Lookup Configurations

For our TBS customers using TBS Kiosks/cPads, the external database lookup function is used for Card ID. PaperCut states that you now need to explicitly enable and configure the feature by adding the following to security.properties in the PaperCut MF/server directory. This is also noted in the PaeprCut UI where this configuration used to be.
Add the following text to the file at the bottom of the file, like so:
- NOTE: New Installs will already have this, and you will just need to configure as follows:

### External Database User Lookup ###
# Controls if external database user lookup for card/ID numbers is enabled.
# When enabled, card numbers swiped or entered at devices can be looked up in an external database.
# Default is N.
# Note: The Application Server must be restarted after modifying any of these settings.
# To enable and configure this feature, set the following keys:
security.card-number-lookup.enabled=Y
security.card-number-lookup.db-driver=com.microsoft.sqlserver.jdbc.SQLServerDriver
security.card-number-lookup.db-url=jdbc:sqlserver://localhost:1433;databaseName=papercut;encrypt=false;trustServerCertificate=true
security.card-number-lookup.db-username=sa
security.card-number-lookup.db-password=PASSWORDHERE
security.card-number-lookup.id-to-username-sql=select user_name from dbo.tbl_user where deleted = 'N' and user_name = {cardnumber}
security.card-number-lookup.id-to-username-sql.user-mapping=USERNAME

Step 3: Restart PaperCut Services

Restart the PaperCut Application Server service to apply changes. (This is also in the above KB Article)
- If upgrading from older versions, stop and disable any PaperCut service you don't use. Example below of the typical library setup:
After restarting, log in to the PaperCut portal and verify the database connection works as expected.

Step 4: TEST, TEST, TEST

TEST the pop-up and Card ID Lookup. (This is also in the above KB Article)
1. TEST POPUP Script: Launch pc-client.exe on the server and print to a MyPC Printer. This will confirm the pop-up is working.
2. TEST CARD ID Lookup: If the popup asks for Card ID and not username/password, then this is the External Card Lookup, and you are testing both at the same time. If the popup asks for username/password, the best test is to log into a cPAD using VNC Viewer. This would be the only other test to confirm the external card lookup is working.

FAQs on Updates and External Card Lookup

Where can I find the latest update for PaperCut?
Visit the PaperCut Software Updates page to download the latest version.
Is my version affected?
Check the Security Advisory for a list of affected versions. If your version is listed, update as soon as possible.
Do I need to reconfigure my card lookup integration after updating?
After updating, review your card lookup integration settings to ensure compatibility and that you're using secure protocols.

Additional Resources

Summary

Addressing the latest PaperCut vulnerability requires prompt action—review advisories, update your software, and secure external card lookup configurations. Stay informed by checking official resources regularly and maintain best practices for ongoing system security.