It's 7:43 AM on a Tuesday. You're the only IT person at your company. Your coffee is still hot. Then your phone buzzes — a security researcher just published a working exploit for PaperCut NG/MF, the print management software quietly running on a server you set up two years ago and mostly forgot about. Huntress is already observing real customer compromises. The patch dropped this morning.
You have no SOC. No incident response retainer. No second set of hands.
This is not a hypothetical. This is the exact scenario that played out when PaperCut's unauthenticated remote code execution vulnerability hit the news — and it will happen again. This week alone, three other critical vulnerabilities followed the same pattern.
The Pattern Is Real and It's Accelerating
Zero-days don't respect your change management calendar. According to The Hacker News, attackers are actively exploiting two SonicWall SMA 1000 zero-days — one rated CVSS 10.0 — that may form an attack chain enabling unauthenticated remote code execution against network appliances. That's the same threat class as PaperCut: pre-auth RCE in infrastructure software that small businesses run and rarely monitor.
The same day, The Hacker News reported active exploitation of a CVSS 9.3 unauthenticated RCE flaw in Sangoma Switchvox SMB Edition — phone system software that sits in small business server rooms across the country, largely unmonitored. And a separate report documented CVE-2026-82329 in JFrog Artifactory, where attackers weaponized an authentication bypass within hours of public disclosure.
The lesson from all four incidents is the same: the window between disclosure and active exploitation is measured in hours, not days. A nuclear agency in the Philippines learned this the hard way — a separate report confirmed attackers gained access through old, unpatched vulnerabilities in ownCloud, infrastructure software the organization had simply deprioritized.
If you're a solo IT admin, you need a playbook before the alert fires. Here's one.
Phase 1: Confirm Exposure Before You Do Anything Else (0–15 Minutes)
The worst thing you can do in a zero-day emergency is patch the wrong system or waste 45 minutes on a server you don't actually run.
Step 1: Verify you're running the affected software. Log into your print server or application server. Check the version number. Cross-reference it against the vendor advisory. For PaperCut, that meant checking whether you were running NG or MF, and which version. Don't assume — confirm.
Step 2: Check for internet exposure. Is the management interface exposed to the internet? Run a quick check on your firewall rules. Many PaperCut installs had port 9191 or 9192 accessible externally — often because someone enabled it for remote management and never locked it back down. If you're unsure what's exposed, this is exactly the kind of gap that a vulnerability scan would have flagged proactively. (We've written about how vulnerability scanning differs from penetration testing — for this use case, scanning wins.)
Step 3: Pull recent logs. Before you patch, look for signs of compromise. In PaperCut's case, indicators included unexpected admin account creation, new user accounts with elevated privileges, and unusual print job activity. Check your application logs for anything that looks out of place in the last 48–72 hours.
Phase 2: Isolate First, Patch Second (15–45 Minutes)
If your exposure window is open and you see any indicators of compromise, isolate before you patch. Patching a compromised server doesn't evict an attacker — it just closes the door they came in through while they're already inside.
- Block external access to the print server at the firewall immediately.
- If you see active IOCs (unauthorized accounts, unexpected processes), take the server offline from the network segment before proceeding.
- Snapshot or image the server if your infrastructure supports it — you'll want that forensic baseline.
If you see no IOCs and the server isn't internet-exposed, you can move straight to patching. But don't skip the log review.
Phase 3: Apply the Patch and Harden (45–90 Minutes)
Patch to the vendor-specified version. Don't assume the latest version is always the patched one — read the advisory. For PaperCut, the emergency patch was a specific point release.
After patching: - Change all service account passwords associated with the print server. - Audit admin accounts — remove any you don't recognize. - Restrict management interface access to internal IPs only, or better, to a management VLAN. - Enable MFA on the admin console if the software supports it. - Review what credentials the print server service account holds — print servers often have broader AD permissions than they need.
This last point matters. Print servers are frequently over-privileged because they were set up with domain admin rights to simplify driver deployment. That makes them a lateral movement goldmine if compromised. As we've covered in our post on shared credentials and printer/MFP security risks, the print stack is one of the most overlooked credential exposure surfaces in small business environments.
Phase 4: Document and Close the Loop (90–120 Minutes)
You're not done when the patch is applied. You need a record of what happened.
- Document the timeline: when you learned of the vulnerability, when you confirmed exposure, when you patched, what you found in the logs.
- If you found any indicators of compromise, this is no longer just a patching event — it's an incident. Notify your cyber insurance carrier. Check your policy for breach notification requirements.
- Update your asset inventory to note the software version, patch date, and exposure status.
If you don't have an asset inventory that includes your print server, you now know why that matters. You can't patch what you don't know you're running. We've written about zero-day vulnerabilities and small business protection and the core finding is consistent: unknown or forgotten assets are where attackers win.
The Bigger Problem: You Found Out Too Late
The PaperCut incident, the SonicWall SMA zero-days, the Switchvox exploit, the Artifactory bypass — in every case, the organizations most at risk were the ones that didn't know they were exposed until the news broke.
A vulnerability scan run before the advisory drops doesn't tell you about the zero-day. But it tells you the management interface is internet-accessible. It tells you the software version is out of date. It tells you the service account has excess privileges. Those findings would have cut your emergency response time in half.
That's the actual value of continuous or regular scanning — not finding the zero-day, but reducing the blast radius when one arrives.
Take Action
If today's post made you realize you don't actually know what's exposed on your network right now — that's the most important thing you can take away.
Oscar Six Security's Radar gives you an external attacker's view of your infrastructure for $99 per scan. It surfaces exposed services, outdated software versions, and misconfigurations before someone else finds them first. No retainer. No enterprise contract. Just actionable findings you can act on — even if you're the only IT person in the building.
Focus Forward. We've Got Your Six.