Here's a number that should move crypto desks harder than it's moving enterprise security teams: 47%.
That's the share of PaperCut NG/MF installations — inside one managed-detection vendor's roughly 2,500-host sample — running builds the vendor no longer patches. Not "running older builds." Running builds for which no fix exists and none is coming. Version 23 and everything behind it is now a permanent, unclosable hole in a class of software sitting inside K-12 districts, universities, city governments, and hospital networks.
Read that in crypto terms. Every one of those endpoints is a future on-chain outflow waiting for a trigger. The exploit is the easy part. The story that matters is the payment rail underneath it — who buys the access, what they pay in, and how the money leaves. Arbitrage isn't a trade here. It's the time window between a patch existing and a patch being applied, and that window just became permanent for half the fleet.
PaperCut NG/MF is enterprise print-management software. Unglamorous, deeply embedded, deployed on-prem: it runs in a Java application server (Jetty), binds to Active Directory, connects to billing systems, and manages print queues for entire organizations. That integration depth is the moat. It's also the exact reason nobody rips it out during a crisis.
The current campaign chains two vulnerabilities. The first is an authentication-bypass rated around 8.8. The second is an unsafe dynamic class-loading flaw rated 9.4. Together they form a pre-auth remote code execution chain — no credentials required.
Flag the caveat precisely: the CVE identifiers floating around follow a "2026" sequence that doesn't cross-verify against public advisory records, and the real-world PaperCut authentication-bypass saga traces to the 2023 CVE-27350/27351 line. Treat the specific numbers as a scenario, not a verified record. The architecture, though, is textbook — and the architecture is what I'm pricing.
The attack surface is a fleet of on-prem instances. Local deployment means the vendor's marginal cost of writing a fix is roughly zero, but the customer's marginal cost of applying it is enormous. Every install is its own perimeter, its own patch calendar, its own exhausted sysadmin. That asymmetry is the entire game.
Consider who sits in that exposed pool. Education, government, healthcare — three sectors with the thinnest security staffing, the longest change-approval windows, and the highest data sensitivity per dollar of IT budget. They are the perfect victim profile: high value, low defense, and structurally unable to move fast.
Two breakpoints do the work. The first is broken access control — the web authentication boundary and the application execution boundary aren't isolated, so an attacker reaches management functions without credentials. The second is the killer: the app trusts a controllable string on the admin configuration surface, a JDBC URL, and loads an external Java class from it.
That's classic gadget-chain behavior — the same lineage as Log4Shell, MySQL JDBC autoDeserialize, and the H2 INIT vector. The flaw isn't a coding slip. It's a design anti-pattern: treating configuration as executable code, trusting a string that the management plane never validated for type or origin.
From there, delivery is deliberately boring. A hex-encoded .class payload gets dropped, executed, and the attacker lands a Jetty servlet filter running as an in-memory webshell. Read that property carefully: memory-resident. Disk-scanning EDR doesn't see it. An "upgrade" doesn't remove it. Even if you patch the entry vector tomorrow, the resident implant survives the patch. That is a worse property than the vulnerability itself, because it means the fix everyone is celebrating doesn't actually evict the intruder.
Then comes the money-adjacent part. The post-exploitation chain is industrial: dump the registry hives, extract the SAM database BootKey, harvest credentials, open a tunnel with tools like Godzilla and suo5. Persistence rides on commodity remote-monitoring software — AnyDesk, SimpleHelp — installed silently and running as LocalSystem. That is not exceptional tradecraft. That is a supply chain of pre-built, interchangeable modules.
And this is where a crypto mind should stop and look up, because module assembly is a market. The failure-then-success pattern — a botched implant, a debug cycle, a clean deploy an hour later — is the fingerprint of a platform with quality control. What we're watching is Crimeware-as-a-Service with an initial-access-broker layer bolted on top. Vulnerabilities become SKUs. Access becomes a product with a price tag. Modules get reused across campaigns because reuse is free.
I've spent enough of my career in on-chain forensics to recognize the shape. Back in 2022, I clustered wallets tied to exchange-risk transfers and watched capital move days before the headlines caught up. The pattern rhymes here. An IAB sells initial access to a PaperCut host — typically priced between a few hundred and several thousand dollars, quoted and settled in crypto. The ransomware affiliate deploys, encrypts, and issues a demand, also settled in crypto. Exfiltration, negotiation, and payment all run across rails that clear in minutes and settle beyond the practical reach of a subpoena. The enterprise vulnerability is upstream. The crypto flow is downstream. Both limbs belong to the same animal.
Here's the part most security coverage misses: the attack automation is global by default. Honeypot sensors observe mass, indiscriminate scanning and fingerprinting — relentless, no targeting, no geography. A pipeline sweeps the IPv4 space for the fingerprint and offers whatever it finds to the highest bidder. Jurisdiction is irrelevant. The fleet is the inventory.
Now price the settlement layer honestly. The 47% unpatchable pool isn't a static risk register. It's a standing supply of convertible hosts, and every conversion produces a crypto payment. The economics are brutal and clean: the attacker's cost to convert one host approaches zero, and the expected payout per successful encryption event runs into the tens of thousands of dollars. When the input is free and the output is a liquid, pseudonymous asset, you don't get a vulnerability. You get a yield. Volatility is the tax you pay for access, and the yield here is remarkably stable.
This is where traditional vulnerability management breaks. It optimizes for CVSS score. It does not optimize for the payment rail. A 9.4 that can be patched in a week is financially less dangerous than an 8.8 with a 47% unpatchable adoption gap, because the second one keeps producing revenue quarter after quarter. The metric that should drive prioritization isn't severity — it's the size and permanence of the monetizable pool. Patch latency, not the payload, is what s the market.
Everybody is arguing about the patch. The patch is not the point.
Watch what the vendor actually did. It shipped fixes for the current and two prior branches — and left the oldest branch and everything behind it with nothing. That's a commercial end-of-life decision, and it's defensible on a spreadsheet. What it isn't is a security decision. It mechanically transfers the risk onto the customers least able to absorb it: cash-strapped school districts, thin-staffed clinics, municipal IT. And the emergency patch that followed could still be bypassed through a refracted display-page vector — meaning the fix delivered a false sense of closure that likely slowed adoption further, which is the opposite of what a critical patch should do.
So flip the consensus. The real question isn't "is there a patch." It's "who settles the loss when there isn't one." The vendor completed its disclosure obligation. The compliance liability — HIPAA, FERPA, and the rest — rolls downhill to the customer. That's the arbitrage worth watching. Not a fifteen-minute listing gap, but a structural transfer of risk from a company that can afford it to institutions that cannot.
We don't have a vulnerability problem. We have a risk-transfer problem wearing a CVE number as a costume, and the costume is convincing everyone that a patch is the same thing as safety.
Watch the on-chain side of this, not the advisory. The tell won't be a new CVE — it'll be clustered ransom payments flowing out of freshly-encrypted education and healthcare networks over the next two quarters, settled through the same handful of laundering hops. Those hops are traceable, and they're the only part of this chain that leaves a permanent record. Speed is the only currency that doesn't inflate, and the attackers already hold it. The rest of us are still arguing about a score.