Every organisation we test has a category of systems nobody owns. They are not in the CMDB, they are not in the NIS 2 scope document, and nobody on the security team has ever connected a finding to them. The print server is usually in this group. So is the mail relay. They were installed years ago, they work, and the implicit assumption is that "working" means "safe".
In August 2026, PaperCut shipped two emergency patches for a vulnerability chain that demonstrated, again, how far that assumption travels from reality.
What the PaperCut chain actually does
CVE-2026-81578 is an authentication bypass in PaperCut MF and NG, rated CVSS 8.8. An unauthenticated request reaches an endpoint that should require credentials — and succeeds. That alone is a meaningful finding: an attacker who reaches the print management interface without logging in can enumerate users, read print history, and harvest credentials stored in device configurations.
CVE-2026-82078, rated CVSS 9.4, extends the impact through unsafe class loading, leading to remote code execution. Chain the two vulnerabilities and an unauthenticated attacker runs arbitrary code on the print server. PaperCut's first emergency patch was bypassed — Huntress reproduced the bypass and reported it — and a second patch followed for versions 24, 25, and 26 on Windows, Linux, and macOS.
The detail that matters for Romanian institutional owners is not the CVSS score. It is that PaperCut servers in universities, hospitals, and local government frequently sit on the network without a dedicated owner, with update schedules driven by "when the vendor calls back" rather than a written policy, and sometimes with a management interface visible from the internet because someone needed remote access once and never reverted the firewall rule.
Exim is in the same category
Mail transfer agents run on roughly the same ownership model. Exim, which holds significant share of the self-hosted mail server market on Linux and is the default MTA in several distributions, received its own critical patch earlier this year for an unauthenticated RCE via chunked SMTP. Exim servers in Romanian institutions share the same pattern as PaperCut: deployed to handle internal or outgoing mail, updated when an administrator remembers, sometimes running versions years behind the current release.
In external penetration tests of Romanian mid-size organisations and public institutions, both PaperCut and Exim appear in scans of the external IP range with some regularity. They appear because someone opened a port, and nobody closed it.
What NIS 2 actually says about asset inventory
Article 21 of NIS 2 requires essential and important entities to implement risk-management measures that include asset management — specifically, maintaining an inventory of network and information systems relevant to service provision, covering hardware and software alike.
The law does not exempt "support services". A print server that processes all internal document output has operational relevance. An Exim instance routing outgoing mail from business applications has operational relevance. The test is not "does it feel critical" but "would its compromise affect service provision or expose data". Both answers are yes.
In Romania, NIS 2 was transposed through Government Emergency Ordinance no. 155/2024 and consolidated by Law no. 124/2025, with DNSC Orders no. 1/2025 and no. 2/2025 providing the operational framework. DNSC's supervisory approach for essential entities is proactive — the directorate can request evidence of inventory and risk assessment without waiting for an incident.
Reporting obligations if these systems are compromised
If a PaperCut or Exim instance is compromised and the incident qualifies as significant under NIS 2 criteria — disruption of service, substantial data exposure, or impact on third parties — the reporting clock starts immediately: an early warning to DNSC within 24 hours, a full incident notification within 72 hours, and a final report within one month, all submitted through the PNRISC platform.
The 24-hour window is difficult to meet if nobody knew the server was in scope. Organisations that exclude print and mail infrastructure from their incident-response runbooks discover this during the incident, not before.
How to verify these systems in an external test
An external penetration test that follows NIS 2 scope expectations starts from the internet and works inward. PaperCut's management interface and the Exim SMTP daemon appear in that scan. If they are reachable, a qualified tester will confirm the exposure, demonstrate what an attacker can do from that position, and document it in a form DNSC can read.
A vulnerability assessment provides the continuous, lower-overhead view: regular scanning of your external IP ranges against current CVE data identifies unpatched PaperCut and Exim versions before an attacker does. Neither approach replaces the other — the assessment finds known vulnerabilities, the test shows what an attacker actually achieves with them.
The NIS 2 compliance audit framework adds the governance layer: who owns the system, what the patch SLA is, and whether both are documented in a form that survives a DNSC inspection.
Three things to do this week
- Scan your external IP ranges and look specifically for PaperCut on ports 9191 and 9192, and for SMTP banners that reveal an Exim version string. If either appears, check the version against the current advisory.
- Assign an owner to every print and mail server in your environment. "IT" is not an owner; a named person with a defined patch SLA is.
- Add print and mail servers to your NIS 2 asset inventory with a classification, an owner, and a last-reviewed date. If either was ever reachable from the internet, include that in the risk record.
Neither PaperCut nor Exim is inherently difficult to secure. The risk comes from the assumption that because they "just work", they do not need the same management cycle as systems that are obviously critical.
This article is general information and does not constitute legal or regulatory advice. For how NIS 2 classifies your specific organisation and its obligations, consult the applicable regulatory framework and your legal counsel.
Sources: BleepingComputer — PaperCut vulnerability chain, August 2026; The Hacker News — PaperCut chain analysis, August 2026; Huntress — PaperCut bypass research; NIS 2 Directive (EU) 2022/2555; DNSC — Government Emergency Ordinance no. 155/2024.