PaperCut's Sep 24 bulletin (updated Oct 13) says NG/MF 26.0.5, 25.0.13, and 24.1.11 already include the fixes that matter for the actively exploited path GreyNoise documented. Check Help → About on every Application Server. If you still expose PaperCut UI or APIs to the internet, put them behind VPN or Zero Trust and restrict admin to bastion hosts — GreyNoise saw domain admin in as little as five to seven minutes after RCE. Also confirm Print and Device Scripting is still off unless you truly need it (off by default since 22.1.1; CVE-2026-14780 needs admin auth when it is on).