Threat actors are exploiting a two-year-old vulnerability in PaperCut that allows them to execute arbitrary code remotely.