Reading a 1.2 Million PaperCut Fingerprint Count Correctly

In September 2026, an array of vulnerabilities in PaperCut NG and MF were exploited publicly, marking the first large-scale real-world use of the flaws. While raw numbers appeared alarming, their interpretation required careful consideration. Searching ZoomEye for instances of "PaperCut" in HTTP bodies returned 1,285,744 matches, while "PaperCut NG" yielded no results, suggesting that the broader "PaperCut" fingerprint captured a wider range of references than just the specific product.

Moreover, the vulnerability query for CVE-2026-81578 returned zero matches, indicating incomplete CVE-index coverage. The vulnerabilities in question, CVE-2026-81578 and CVE-2026-82078, permitted an attacker to bypass authentication and execute remote code, constituting a severe security risk. Public proof-of-concept code for the exploit chain existed, and a Metasploit module proposal had been submitted.

The large fingerprint counts did not equate to a vast population of vulnerable servers; instead, they highlighted the prevalence of the PaperCut name across internet-facing infrastructure. The correct approach to assessing real-world exposure involved verifying internal inventory, comparing server versions against patched releases, and restricting external access to such servers.

The lesson drawn from the incident was that a large fingerprint count did not automatically imply a large number of vulnerable assets; it was crucial to understand what the query was actually measuring.