Hackers Use Hundreds of AI Agents to Exploit PaperCut Servers and Steal Windows Credentials
A threat actor used AI agents to exploit PaperCut, compromising about 440 servers and stealing Windows credentials.
88
CVE-2026-81578
Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
CISA: PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
- CVSS 4.0
- 8.8 high
- EPSS
- 84%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-81578 is an improper access control flaw (CWE-305) in the web management interface of PaperCut MF and PaperCut NG in which administrative requests from unauthenticated remote users trigger backend actions before access validation completes. An attacker can invoke administrative functions without logging in, allowing modification of certain system configurations. When chained with CVE-2026-82078 (unsafe dynamic class loading), the flaw has been used to achieve unauthenticated code execution. Any organization running PaperCut NG/MF, particularly servers whose web management interface is reachable from the internet or untrusted networks, is affected. The vulnerability was added to CISA KEV on 2026-08-31 and is being exploited in the wild as part of an AI-orchestrated campaign that compromised roughly 395–440 organizations.
What to do: Apply the vendor's patches for PaperCut NG/MF per vendor instructions, as required by CISA BOD 26-04, ensuring the fix also covers companion CVE-2026-82078; prioritize internet-facing print servers. Until patched, restrict the PaperCut web management interface to trusted networks only. Given the active AI-orchestrated campaign hitting 395+ organizations, review PaperCut servers for unexpected configuration changes and other indicators of compromise.
| Product | Affected |
|---|---|
| PaperCut MF | — |
| PaperCut NG | — |
Estimated exposure
largetens of thousands of PaperCut NG/MF servers, plausibly ~10,000–100,000 internet-reachable instances across the ~100,000+ organizations reported to use PaperCut — PaperCut NG/MF is a widely deployed self-hosted print-management platform used by roughly 100,000+ organizations, and public internet scans of its web management interface routinely reveal tens of thousands of reachable servers.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
KEVCISA Known Exploited Vulnerability
- Affected
- PaperCut NG/MF
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- papercut
- Products
- papercut mf, papercut ng
- Weakness
- CWE-305
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
20 storiesAI-powered attack exploited PaperCut flaws to hack 395 organizations
AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.
88
CVE-2026-81578 + CVE-2026-82078 | PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilities
Two chained PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, enable pre-auth RCE, with active exploitation confirmed in customer environments.
88
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
watchTowr details a PaperCut pre-auth RCE chain exploited in the wild and repeated patch bypasses.
86
Attackers Use PaperCut RCE Chain to Steal Tokens and Access Domain Controller
Attackers chained PaperCut MF zero-days CVE-2026-81578 and CVE-2026-82078 to deploy a web shell and dump Active Directory from a domain controller.
86
PaperCut NG/MF Critical Zero-Day Exploited in the Wild
PaperCut confirms active exploitation of critical zero-days CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF print management software, with confirmed customer incidents.
86
PaperCut NG/MF Zero-day Vulnerability Exploited in the Attacks (CVE-2026-82078 & CVE-2026-81578)
PaperCut NG/MF zero-days CVE-2026-82078 and CVE-2026-81578 are actively exploited, chaining to pre-auth RCE on the Application Server.
84
Hackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide
Attackers used Codex and DeepSeek agents to exploit PaperCut flaws and compromise 440 servers in 48 countries.
82
AI agents exploited PaperCut flaws to breach 395 organizations
GreyNoise says AI agents running OpenAI's Codex with DeepSeek exploited PaperCut flaws, compromising 440 instances across 395 organizations in 48 countries.
82
Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script
Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.
82
Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
82
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.
82
Hackers Turned a PaperCut Print Server Into a Path to the Domain Controller
Attackers chained two PaperCut MF zero-days to reach an education customer's domain controller in under two days.
80
Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.
80
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut shipped maintenance releases replacing emergency patches for two actively exploited flaws abused in AI-assisted attacks on 395 organizations.
78
Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
78
Attackers plant remote access tools on compromised PaperCut servers
Attackers chained two PaperCut NG/MF zero-days for unauthenticated access, installing SimpleHelp and AnyDesk remote access tools on compromised servers.
78
PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
PaperCut warns of actively exploited zero-day RCE chain CVE-2026-81578 and CVE-2026-82078 affecting all PaperCut NG and MF versions.
78
PaperCut warns of hackers using printer management software flaw in attacks
PaperCut warns of active exploitation of CVE-2026-82078 and CVE-2026-81578 in NG/MF print management software used by universities, corporations, and governments.
78
PaperCut Flaws Exploited in AI-Powered Attacks
GreyNoise says a Russian-speaking actor used AI to build and deploy exploits hitting 440 PaperCut NG/MF deployments across 395 organizations in 48 countries.
77