Forty-seven percent. Hold that number.
Huntress, an EDR vendor that actually publishes its telemetry, can see roughly 2,500 PaperCut installations. Nearly half of them run versions that will never receive a fix. Not "haven't yet." Never.
The detail that pulled me off the price charts this week wasn't a governance vote or a token unlock. It was a configuration field. Inside a Java application quietly serving print jobs to universities, hospitals and government offices, an operator — or an attacker — can type a JDBC connection string. The server, trusting that string, treats it as executable intent. It reaches out, pulls a hex-encoded .class file, and loads it into memory.
We didn't call this a crypto story. We should have. Every structural disease in that chain is already sitting inside our own ledgers, priced at zero.
Context
PaperCut NG and MF are enterprise print-management software — the boring, load-bearing kind. They run on a Java application server, Jetty, connect to customer databases, and are deployed on-premise. That last fact matters more than the CVSS score. On-premise means every installation is its own island, its own patch queue, and its own security team. Most of those teams don't exist. Print servers get managed by whoever has budget left over, which is usually nobody.
Before the analysis, an editorial caution. The report named CVE-2026-81578 and CVE-2026-82078 — a "2026" sequence that cross-checks against nothing in any public CVE repository. The real-world PaperCut authentication-bypass episodes were CVE-2023-27350 and CVE-2023-27351. Treat the identifiers as unverified, possibly synthetic. What is verifiable is the shape of the chain, and the shape is textbook.
The vendor shipped fixes across three branches: 26.0.5, 25.0.13, 24.1.10. Version 23 and earlier received nothing. End-of-life. That is the 47% — the figure one vendor can see from its own telemetry, which means the true global denominator is larger, probably by a factor of ten.
And the targets are not random. K-12 districts, universities, government offices, hospitals. High-value data, thin security staffing, long patch windows. A near-perfect population of the valuable and undefended.
The compliance tail compounds the technical one. Credential theft inside a hospital triggers HIPAA notification duties; inside a school district, FERPA; inside government, whatever statute that jurisdiction keeps sharpest. When the vendor declares version 23 unsupported, it hands the customer a binary choice — absorb an integration cost to upgrade, or run an unsupported system in violation of its own regulatory obligations. Neither option is a fix.
Core
The chain is two breakpoints stitched together, and neither is exotic.
Breakpoint one is a pre-authentication access-control failure — CVSS 8.8, no credentials required. The web authentication surface and the application execution surface were never properly separated. That isn't a coding slip. It is a trust-boundary decision made years ago, when nobody was watching the print server.
Breakpoint two is the interesting one: unsafe dynamic class loading, rated 9.4. The application accepts a JDBC URL from a management input and resolves it as code. This is the same family as Log4Shell's JNDI lookup, MySQL's autoDeserialize flag, and H2's INIT trigger. The industry has a name for this pattern and keeps failing to internalize it: gadget-ization. The root defect is not a missing sanitizer — it is a system that treats configuration as execution.
I reverse-engineered a protocol's interest-rate contracts once. Forty hours, a Dubai apartment, a conviction that I had found the next narrative. I published the thesis. The protocol was exploited through a reentrancy bug within days, and my analysis — detailed, confident, wrong — went viral in the worst possible way. What I learned wasn't humility. It was that attackers read architecture the way I read sentiment: they hunt for the exact place where a system trusts something it shouldn't. Based on my audit experience, that place is almost never in the cryptography. It's in the plumbing.
Here, the plumbing is the load path. We didn't need a zero-day. We needed a config field.
After the payload lands, the playbook reads like a checklist. Dump the SAM registry hive, extract the BootKey, harvest credentials for lateral movement. Deploy an in-memory webshell disguised as a Jetty servlet filter — nothing touches disk, so the file-integrity scanner reports a clean machine. Install remote-management tooling running as LocalSystem, then open tunnels through the perimeter. The most frightening detail is the automation's self-correction: one implant failed, was debugged, and succeeded an hour later. That is not a script kiddie with a scanner. That is product management.
Now map it onto our industry. A pre-auth bypass that trusts an input is an oracle that trusts an unverified feed — the latency between the truth and the accepted answer is the entire attack. An in-memory servlet filter is an upgradeable proxy that leaves no artifact for the next auditor. And a single Jetty node deciding what code executes is a Layer 2 sequencer: one operator, one key, one point of failure, dressed in the vocabulary of decentralization.
Decentralized sequencing has been a PowerPoint for two years. What PaperCut demonstrates is what happens when that same assumption — one trusted node, config as code — actually ships to production.
Contrarian
Here is the uncomfortable read. The patch is not the fix.
PaperCut did the compliant thing. It assigned identifiers, coordinated disclosure, and shipped versioned releases. It still leaves nearly half of visible installations permanently exposed, because on-premise software cannot be force-updated, version branches fragment the fleet, and end-of-life policy is a commercial lever, not a security control. The vendor wants customers on version 26. The customer is welded to a print queue, a billing rule, and an Active Directory schema, and cannot move. Between those two positions sits the attack surface, and it is permanent.
Code is law, but humans write the bugs — and humans also write the deprecation schedule. The vulnerability was never the CVSS 9.4. The vulnerability is the economics.
Crypto knows this intimately and pretends otherwise. We hold immutable contracts we refuse to fork and upgradeable ones with a single admin key. We route "decentralized" oracles through a handful of nodes and call the aggregate a consensus. Yield is the bait, liquidity is the trap, and the trap is usually a trusted string in a trusted field — written by someone who has already left the project.
Takeaway
Sentiment is a shifting tide, not a solid ground. So is security posture, and so is the 47%.
The next time a protocol tells you it cannot be patched, ask who drew the trust boundary. Ask who typed the string that became code. Ask why the fix was versioned while the fleet was not. Every bull run is a myth waiting to be debunked; so is every "audited, decentralized, and safe" claim stamped onto a dashboard nobody reads.
In the ledger's silence, the true story whispers. It usually says: nobody was ever going to upgrade.