Enhancements

• User Client: The authentication popup window now automatically takes focus when triggered by unauthenticated (anonymous) print queues. This allows users on shared workstations to swipe their ID card immediately, without first having to click the popup. [PO-3062]
• Scan to Cloud: Updated the existing “Disable notification for completed scans” setting to prevent confirmation emails from being sent when scanning to cloud storage destinations, including OneDrive, SharePoint, and Google Drive. [PO-3854]
• Accessibility: Improved screen reader and keyboard accessibility in the User web interface. Changes cover the Summary, Transaction History, Web Print, and Recent Print Jobs pages. The activity chart on the Summary page has clearer descriptions and an improved page structure, and the filters on the Recent Print Jobs page are easier to use with assistive technologies. [PO-4639], [PO-4856], [PO-4857]
• Diagnostics: The server debug log now records the host system’s total memory at startup, making performance and configuration issues easier to diagnose. [PO-4669]
• External database card ID lookup: The security.properties file now explains how to turn on the external database card ID lookup feature, and how to secure the database credentials that PaperCut NG/MF uses to connect to the database. For help with upgrades, look in security.properties.template instead. [PO-4621]

Fixes

• Fixed an issue where the Admin interface loaded slowly on systems with a very large number of accounts. [PO-4281]
• Fixed an issue where no warning was shown if legacy external database settings for card/ID lookup were still configured, but external lookup wasn’t enabled in security.properties. A warning now appears once per server startup in the Application Log and the server log. [PO-4599]
• Fixed an issue where filtering Job Logs by Printer/Device Group did not filter the results. [PO-4290]
• Fixed an issue on Printers > Charts where print queues with the same name on different servers were combined in one chart but shown separately in the others. [PO-4596]
• Fixed an issue where some of the sample print scripts (recipes) supplied with PaperCut MF stopped running after upgrading to 26.0.4 or later. The affected scripts have been updated. [PO-4615]
• Fixed an issue found in 26.0.3+ where the nightly print log redaction could cause the Application Server to run out of memory on systems with a large number of print logs. [PO-4678]
• Fixed an issue where daily maintenance could generate an excessive number of update packets for Site Servers after a user/group sync. [PO-4603]
• Fixed an issue in the Admin web interface, on a printer’s Statistics tab (Printers > printer name > Statistics). When the page first loaded, the “Gather statistics over” dropdown showed “Yesterday”, but the summary and graph showed the last 7 days. Also fixed an issue where the “Yesterday” graph covered the wrong dates and showed no usage. [PO-4595]
• Fixed a cosmetic issue in the Linux installer where upgrading would incorrectly display a “sed: can’t read : No such file or directory” error message. [PO-4591]

Copier / Device Integration

New Ricoh embedded app - Ricoh (SmartSDK) v2

The all-new Ricoh MF (SmartSDK) v2 Full Embedded app is a completely rebuilt experience, designed from the ground up to elevate PaperCut MF on Ricoh devices. It introduces a modern, intuitive user interface that is consistent with other PaperCut MF embedded applications, making it easier to use for users and administrators alike. New features include:

• a faster, more responsive user experience
• a user experience aligned with other PaperCut MF embedded apps
• a simplified ‘one-click’ installation process
• quick upgrade from the old app to the new with ‘one-click’
• the new app auto-updates when updating your PaperCut MF server
• no device access required to accept certificates
• bulk installation (and bulk upgrade) available via CSV.

New Konica Minolta (BSI) Full Embedded app

Introducing a new embedded application for new Konica Minolta devices based on the BSI platform.

• Support for new Konica Minolta devices that run on the BSI platform.
• This new app includes Integrated Scanning.
• There are two new device types:
  • Konica Minolta BSI
  • Konica Minolta BSI (Printer Only)

New Sharp OSA (LE version)

Previously available via a separate build, Sharp OSA (LE version) is now available in PaperCut MF by default.

Fixes

• Brother:
  • Users can now return to the PaperCut Home screen after using native device features, such as checking their balance, without logging out and back in. This requires additional setup; see the embedded manual for assistance. [CDSS-7820]
  • Fixed an issue on Brother embedded where canceling or completing a scan with a single available action refreshed back to the confirmation screen instead of returning to the main menu. [CDSS-7745]
• Canon: Fixed an issue where devices could intermittently prompt for manual acceptance of a CA-issued server certificate, particularly over slow or unstable networks. [CDSS-7589]
• Konica Minolta: Fixed intermittent authentication issues on Konica Minolta devices. [CDSS-6892]
• Ricoh (SmartSDK): New ROC tool version 1.5.4
  • Fixed an issue where the ROC tool could report errors when configuring multiple devices at the same time. [CDSS-7722]
  • Updated Log4J to 2.26.1 [CDSS-7895]
• Xerox: Fixed an issue where the account confirmation screen appeared on AltaLink devices even though “Show account confirmation” was disabled. [CDSS-7575]
• Xerox eSF (FLS 3.1.20): Added support for the following models: MX73x, MX83x, MS73x, MS83x, and XM74x. Note: This update applies across the shared eSF framework for Lexmark, Sharp, Toshiba, and Fujifilm. [CDSS-7748]
• Fixed an issue where PDF scans of more than nine pages received via a Site Server could have had pages joined in the wrong order. [CDSS-7759]

Security

• Updated third-party components used by the Application Server, including its web server and security framework, to address potential vulnerabilities referenced by CVE-2026-22732, CVE-2026-47838, and CVE-2026-41706. [PO-4597]
• Updated the RequireJS library used in the web interface to address CVE-2024-38999. [PO-4608]
• Removed a deprecated endpoint. [PO-4504]

Print Provider

• Improved command line handling [PIE-1070], [PIE-1071], [PIE-1072]
• Fixed an issue with page-level color detection where certain PostScript print jobs (submitted from the Mobility Print Android app, Web Print and from the Linux GUI) were incorrectly analyzed as grayscale. [PIE-1089]
• Bundled the latest Universal Print Connector v2026-10-13-1252. For more information, see Universal Print Connector release notes.

Other notes

• * indicates these devices require installing an updated version of the embedded software to access new features and fixes.
• This version does not contain a database upgrade.

Enhancements

• Apple Silicon Support: The Application Server, Print Deploy Server, and Site Server now support native Apple Silicon (ARM64) on macOS. These applications run directly on Apple Silicon (ARM64) Mac hardware without requiring Rosetta 2 emulation. [PO-4407], [PO-2583]
• Cybersource Payment Gateway: Added support for Cybersource Unified Checkout Payment Gateway. This updates the integration ahead of Cybersource’s End-of-Life (EOL) for the Secure Acceptance interface on September 30, 2026, ensuring uninterrupted payment processing. For details, see the Payment Gateway Module release notes. [PO-4112]

Fixes

• Fixed an issue where deleting a batch of top-up cards that contained redeemed cards could cause unexpected errors or unintended user data modifications. [PO-4521]
• Fixed an issue in the Admin web interface where notification text fields under Options > General (for user refund requests) were truncated. [PO-4477]
• Fixed an issue where the print release touchscreen on embedded devices failed to render when a print job filename contained emojis. [PO-4468]
• Fixed an issue where selecting ‘Outlook with OAuth (US Gov)’ routed authentication requests to global Microsoft endpoints rather than the US Government Cloud. Note: Saving this setting also aligns the Microsoft user sync region to US Gov. [PO-4322]
• Fixed an issue where manually triggering a shared account sync could fail with the error ‘Unable to access the import directory or file: null’. [PO-4523]
• Fixed an issue where saving configuration changes (such as Job Redirection) in environments with more than 1,000 print queues could result in an error showing “400: unable to parse form content” and fail to save the changes. [PO-4519]
• Fixed an issue where processing certain print jobs with zero calculated pages could cause high CPU and memory usage on the Application Server. [PO-4506]
• Added a warning for SysAdmins when saving an Advanced Scan Action that displays when the destination setup relies on optional prompt fields. The warning explains that if users leave the optional fields blank at the device, it could potentially lead to file-naming or delivery failures, and recommends making the fields mandatory. [PO-4423]
• Fixed an issue on recent macOS 27 beta builds where right-clicking the menu bar icon did not open the dropdown menu. [PO-4485]
• Fixed a regression introduced in the August 27, 2026 security patch Release 2, where Single Sign-On (SSO) authentication using third-party identity providers (such as Google, Microsoft, or Okta) prevented login. [PO-4562], [PO-4583]

Copier / Device Integration

New Brother embedded app

• Added a new Brother embedded application supporting PaperCut Integrated Scanning. This release adds two new device types. [CDSS-6587]
  • Brother BSI
  • Brother BSI (Printer Only)
  • The current Brother device type has been renamed Brother Legacy (EOL).
  • Note: For newer Brother device types, you must upgrade to 26.0.4 before applying a license.

Fixes

• Canon v1.3.4*: Fixed an issue with zero stop, improving color detection accuracy to better prevent unauthorized color printing. [CDSS-7238]
• Xerox eSF (FLS 3.1.19): Added support for new Xerox models: C305ae, XC2432, and ZC364. Note: This update applies across the shared eSF framework for Lexmark, Sharp, Toshiba, and Fujifilm. [CDSS-7166]
• Fixed an issue where the ‘print as grayscale by default’ setting on various embedded devices was not applied if a print job was received while the user was actively logged in at the device. [CDSS-7142]
• Fixed an issue on Windows web browsers where advanced setup options for Sharp OSA devices were not displayed in the PaperCut administration console. [PO-4479]

Security

• Fixed an improper access control vulnerability that exists in the web management interface of PaperCut MF and PaperCut NG. (CVE-2026-81578). [PO-4560]
• Fixed an unsafe dynamic class loading vulnerability that exists in the database connection used in the external card/ID user lookup feature. (CVE-2026-82078) [PO-4564], [PO-4575]
• Hardened the external database configuration for card/ID user lookups configuration. This has now been moved into the security.properties configuration file. Important: After upgrading, organizations using this feature will need to reconfigure as per setup instructions. [PO-4564], [PO-4575]
• Updated third-party dependencies. [PO-4433], [PO-4478]
• General security improvements and hardening identified during an internal security review. [PO-4568]
• Note: This release includes all security fixes that were incorporated into the August 27, 2026 Security Bulletin Emergency Patches.

Print Provider

• Added native Apple Silicon (ARM64) support for the Print Provider (includes Secondary Server software and Direct Print Monitor software). [PIE-921]
• 3rd party library upgrades. [PIE-1068]
• Fixed an issue on macOS where redirected print jobs could result in corrupted or truncated prints due to missing spool data. [PIE-1087]

Other notes

• * indicates these devices require installing an updated version of the embedded software to access new features and fixes.
• This version does not contain a database upgrade.

Enhancements

• Integrated Scanning: Added automatic page rotation to OCR scan actions, eliminating manual orientation fixes for end users. This feature is updated automatically for Cloud Document Processing. For self-hosted Document Processing, it requires upgrading this service to version 1.1.37. For more information and to access the installer please see set up self-hosted Document Processing. [CDSS-6946, PO-345, PO-542]
• Watermarking and digital signatures: Added support for the HMAC SHA-256 algorithm to help organizations meet regulatory security compliance. When configuring print job annotations, System Administrators can now use the new %sig_sha256% and %digest_sha256% variables for more secure cryptographic signatures. [PO-4289]
• macOS User Client and Release Station: Added native Apple Silicon (ARM64) support for the PaperCut User Client, Release Station, and local installer. These applications now run natively on Apple Silicon Mac computers without requiring Rosetta 2 emulation. [PO-4368]
• Notification Emails: Updated the pending refund notification email to show key transaction details, usernames, and requested refund amount of each request. This provides administrators with immediate context on pending requests without needing to log into the PaperCut admin console. [PO-4235]

Fixes

• Fixed an issue on the Web Print User web interface that sometimes caused the submit button to remain active after being clicked. Users can no longer accidentally submit duplicate print jobs by repeatedly clicking the button. [PO-4470]
• Fixed an issue on Site Servers running version 26.0.2 where cloud-based Integrated Scanning actions (such as Scan to Email and cloud storage destinations) failed to appear on the MFD interface. See known issue PO-4461 for more information.
• Fixed an issue on macOS where upgrading the PaperCut Application Server from version 24.1.5 or earlier could cause the installer to time out and fail. [PO-4330]
• Fixed an issue affecting macOS environments where users were prematurely logged out of the PaperCut User Client. Previously, under certain network conditions involving IPv6 addresses, a single user’s session expiration could inadvertently disconnect other active client sessions. See known issue PO-4041 for more details.
• Fixed an Integrated Scanning issue on HP, Sharp, Konica Minolta, and Canon devices to improve scanning disk activity by up to 50% (or 33% if scan archiving is enabled). [PO-4346]
• Fixed an issue where installing a new perpetual license in the Admin Interface, exceeding its device limit, required a full manual Application Server restart. The license status now updates immediately after installing the license. [PO-4095]
• Fixed an issue where daily database maintenance tasks could consume high memory and impact Application Server stability on systems with large databases. [PO-443]
• Fixed an issue on the Users list page where screen readers could not fully read data table cells. Improved keyboard navigation and added standard accessibility properties to ensure screen readers uniquely identify and announce cell content correctly. [PO-4218]
• Print Deploy (v1.10.4437): Introduced an enhanced auto-update mechanism using digitally signed payloads in line with security best practices. Note: Actioning this security enhancement requires an over-the-top client reinstall. For full release details, KB guides, and client update instructions, please see the Print Deploy Release Notes.

Copier / Device Integration

• Konica Minolta: Fixed an issue where logging into the PageScope Web Connection (PSWC) interface while a physical session was active at the MFP panel could cause the web session to incorrectly inherit the panel user’s identity. [CDSS-7012]
• Reduced excessive load on the database caused by embeddeds caching persistent config values. [CDSS-7339]
• Fixed an issue across various OEMs that stopped users from being automatically enabled again when trying to access the device and the ‘Disabled Printing’ timer had expired. [CDSS-7442]
• Fixed an issue where clicking the “Begin Auto Setup button” for Sharp devices failed to display the setup progress window, even though the device was successfully created in the background. [PO-4443]
• Fixed an issue on Toshiba V3+ device types where Integrated Scanning using the Automatic Document Feeder (ADF) failed with an error when the PaperCut Application Server used certain regional language settings, such as Serbian (Latin, Bosnia and Herzegovina). [PO-4323]

Security

• Fixed a timing issue on the Admin interface login page to protect against potential user enumeration via slight differences in authentication response times. (CVE-2026-8794). [PO-4320]
• Fixed an MFD login issue for failed login attempts to prevent rapid, automated brute-force login attempts. (CVE-2026-8793). [PO-4319]
• Improved payment gateways security by hardening the “Add Credit” and administration interfaces across all payment gateway integrations against potential Cross-Site Scripting (XSS) vulnerabilities. [PO-3920]

Other notes

• * indicates these devices require installing an updated version of the embedded software to access new features and fixes.
• This version does not contain a database upgrade.

New Features

SAML 2.0 Authentication

• This feature introduces SAML 2.0 for single-sign-on support (SSO), enabling PaperCut NG/MF to integrate with external Identity Providers (IdPs) such as Microsoft Entra ID, Okta, and Ping Federate. This allows System Administrators to provide a consistent login flow and leverage IdP security features, including Multi-Factor Authentication (MFA), across all PaperCut touchpoints to significantly enhance environment security. [PO-4158], [PO-638]

Unified Authentication

• We have redesigned the authentication architecture to provide a persistent “sign-in once” experience across the login web interfaces, Print Deploy, and the User Client. This reduces login fatigue for users and simplifies identity management for System Administrators by maintaining a single authenticated session across the platform.

EOL Device Management

• To bolster environment security, PaperCut MF 26.0+ disables legacy End-of-Life (EOL) devices by default. During the upgrade, administrators will need to acknowledge this change, as your end-of-life devices will be disabled. If required, you can re-enable support for these device types via a toggle in Options > Advanced (subject to a risk disclaimer and System Log entry). Once re-enabled, legacy devices will resume communication, and new end-of-life devices can be created (not recommended). Persistent “EOL” status banners and indicators will remain in the admin interface to help identify hardware that might require replacement. [PO-3930]

Fixes

• Fixed an issue where logging out of the Mobile Print Release or Web Client interface could trigger an unintended background login request. [PO-1411]
• New payment gateway version available for Touchnet customers. For more information, see Payment Gateway Module Release history. [PO-4327], [PO-4404]
• Fixed an issue where upgrading to version 26 could cause the Application Server service to fail at startup if legacy custom memory configurations (such as MaxRAMFraction) were used in server.conf. Most environments are automatically migrated to modern arguments, but some edge cases may require manual intervention due to a Java update. See known issue PO-4393 for more information.
• Fixed an issue where temporary files (prefixed with ‘MultiPart’) generated during scanning workflows on certain devices, such as HP, were not being automatically cleaned up. These files are now properly removed upon job completion, preventing unnecessary disk space accumulation in the server's temporary directory. [PO-4288]
• Fixed an issue on the Users page where sorting the user list by balance could cause the page to crash when the 'multiple personal accounts' feature is enabled. [PO-4415]
• Fixed an issue in Integrated Scanning where scan jobs could fail or default to generic filenames (such as scan.pdf) if a substitution variable (like {{device_location}}) contained special characters such as slashes (/, \) or colons (:). [PO-4273]
• Fixed an issue on the Printers page where disabling a printer could cause an error screen to display, locking the administrator out of the printer's settings. [PO-4372]
• Fixed an issue in version 26.0.2 (builds 76096 and 76097) where users encountered an error on the User Portal summary page, relating to Payment Gateways. See known issue PO-4444 for more information.

Copier / Device Integration

Modern Embedded App User Interface

We have introduced a refreshed, modern user interface for supported embedded MFDs, providing a consistent experience aligned with the PaperCut Hive interface. This update simplifies the user experience at the device, making it more intuitive for end-users. For new installations of PaperCut MF v26.0, the Modern UI is enabled by default. For upgraded systems, the Classic UI is retained, allowing System Administrators to transition devices to the Modern UI at their own pace via Options > General > Device Options. [CDSS-6054]

Fixes

• HP OXP: Fixed an issue on HP devices where the native HP footer was visible when using the 'Modern Embedded Interface', preventing the PaperCut MF application from displaying in full screen. [CDSS-7082]
• Xerox EIP 1.5+: Fixed an issue where 'Select Account' list shows accounts by name when the select 'By Code' is set as default. [CDSS-7059]
• Fixed an issue where an incorrect device status was displayed if invalid administrative credentials were provided during installation. [CDSS-6899]
• Sharp OSA N2: Fixed an issue where the macOS printer auto-configuration tool failed to run on certain versions of macOS. [CDSS-7042]

Security

• PaperCut NG/MF Version 26 includes upgrades of core dependencies and several third-party libraries. [PO-3782], [PO-4156], [PO-3511], [PO-4227], [PO-3567], [PO-4224], [PO-4063], [PO-4109], [PO-4277]
• Significant improvements to internal user authentication speed. The hash encode strength was set too high. The default is now 12. Admins can change the strength in the security.properties file by editing user.internal.hash-encode.strength to a value between 4 and 31. [CDSS-6543]

Other notes

• * indicates these devices require installing an updated version of the embedded software to access new features and fixes.
• This version contains a database upgrade.