Which versions of PaperCut Print Deploy are affected by CVE-2026-6645?

PaperCut Print Deploy Client for Windows contains a local privilege escalation vulnerability (CVSS 7.3) allowing standard users to achieve SYSTEM-level access on affected endpoints; no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-6645?

Within 24 hours: Audit systems running PaperCut Print Deploy Client for Windows and identify scope of affected endpoints; document current PaperCut version deployed. Within 7 days: Implement interim controls including restricting write permissions to system directories and Windows PATH locations, disabling print updater services where operationally feasible, and deploying Windows Defender Application Control (WDAC) or AppLocker to whitelist pc-printer-updater.exe. Within 30 days: Monitor PaperCut security advisories and vendor site for available patch; prepare and test deployment plan for immediate remediation upon patch release.

PaperCut Print Deploy CVE-2026-6645

Q: What is the CVSS score of CVE-2026-6645?

CVE-2026-6645 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-38209 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-06-22 eb41dac7-0af8-4f84-9f6d-0272772514f4

GHSA-7rjc-r662-4qm8

Information Disclosure Microsoft

7.3

CVSS 4.0 · Vendor: eb41dac7-0af8-4f84-9f6d-0272772514f4

Severity by source

Vendor (eb41dac7-0af8-4f84-9f6d-0272772514f4) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.7 MEDIUM

Local low-priv attacker (AV:L/PR:L); AC:H because a writable search-path directory must already exist; UI:R for the updater invocation; full CIA impact as SYSTEM.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (eb41dac7-0af8-4f84-9f6d-0272772514f4).

CVSS VectorVendor: eb41dac7-0af8-4f84-9f6d-0272772514f4

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 22, 2026 - 06:16 EUVD

Analysis Generated

Jun 22, 2026 - 06:12 vuln.today

CVE Published

Jun 22, 2026 - 04:17 cve.org

HIGH 7.3

DescriptionCVE.org

An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, which typically operates with high-level system privileges, attempts to perform an internal validation check by invoking a secondary system utility using an unqualified file reference.

Because the application does not specify an absolute path to this utility, it relies on the operating system's default search order to locate the executable. Under specific conditions, a local attacker with the ability to modify directories within the system's search path could plant a malicious binary that mimics the expected utility. This could result in the malicious code being executed with SYSTEM privileges, leading to a full compromise of the affected host.

AnalysisAI

Local privilege escalation to SYSTEM in the PaperCut Print Deploy Client for Windows allows a low-privileged user to hijack execution flow of pc-printer-updater.exe by planting a malicious binary in a directory on the Windows search path. The flaw is a classic uncontrolled search path element (CWE-427) in a SYSTEM-level helper, and no public exploit identified at time of analysis. CVSS 4.0 base score is 7.3 reflecting local vector with attack requirements and user interaction.

Technical ContextAI

The pc-printer-updater.exe is a helper component of PaperCut Print Deploy Client that runs at elevated privilege to push printer driver/configuration updates to Windows endpoints. During an internal validation step it spawns a secondary Windows utility using only the executable's base name rather than an absolute path. Windows then resolves the name using the documented search order (application directory, system directories, current directory, and PATH), which is the root-cause pattern enumerated by CWE-427 (Uncontrolled Search Path Element). If any earlier-resolving directory is writable by a non-admin user, a same-named malicious binary will be loaded in place of the legitimate utility and inherit the parent process's SYSTEM token. The references point only to the PaperCut June 2026 security bulletin, so the exact utility name and the precise search-order location used by the validator are not disclosed in the public NVD data.

RemediationAI

Patch available per vendor advisory - upgrade the PaperCut Print Deploy Client to the fixed build listed in the PaperCut NG/MF June 2026 security bulletin (https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-june-2026/); the exact fix version is not reproduced in the NVD record and should be taken from that bulletin. Until clients can be updated, audit every directory on the SYSTEM PATH and on the install path of pc-printer-updater.exe and remove write/modify ACLs for non-administrative users (a common offender is C:\ on legacy installs and any custom directories prepended to PATH by third-party software); side effect is that legitimate installers that drop files into those locations may fail. As a second compensating control, restrict the ability of standard users to write executables to user-writable directories on the search path via AppLocker or WDAC publisher rules covering the updater's working directory - note this adds policy maintenance overhead and may block benign utilities. Do not attempt to stop pc-printer-updater.exe outright, as that will break printer deployment.