Attackers Use PaperCut RCE Chain to Steal Tokens and Access Domain Controller
Attackers chained PaperCut MF zero-days CVE-2026-81578 and CVE-2026-82078 to deploy a web shell and dump Active Directory from a domain controller.
86
Organization
PaperCut
- Mentions · 7d0
- Mentions · 30d0
- All mentions10
- First seenAug 31, 2026
- Last mentionedSep 30, 2026
Timeline
10 articles · newest firstPaperCut Flaws Exploited in AI-Powered Attacks
GreyNoise says a Russian-speaking actor used AI to build and deploy exploits hitting 440 PaperCut NG/MF deployments across 395 organizations in 48 countries.
77
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut shipped maintenance releases replacing emergency patches for two actively exploited flaws abused in AI-assisted attacks on 395 organizations.
78
Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script
Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.
82
AI-powered attack exploited PaperCut flaws to hack 395 organizations
AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.
88
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.
82
PaperCut Flaws Exploited in Attacks on U.S. and European Schools
Attackers are chaining recently disclosed PaperCut flaws CVE-2026-81578 and CVE-2026-82078 to steal credentials and create privileged accounts at US and European schools.
75
Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.
80
CVE-2026-81578 + CVE-2026-82078 | PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilities
Two chained PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, enable pre-auth RCE, with active exploitation confirmed in customer environments.
88
PaperCut security advisory (AV26-858) – Update 2
CISA added actively exploited PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078 to KEV; Canada's Cyber Centre urges Emergency Patch Release 2 for v24-v26.
72
Related CVEs
by mentions- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2021-4228777%7.5Privilege Escalation in Microsoft Active Directory Domain Services
- CVE-2021-4227873%7.5Privilege Escalation via sAMAccountName Spoofing in Microsoft Active Directory
Appears with
- PaperCutvendor · 9
- PaperCut NGproduct · 8
- PaperCut MFproduct · 8
- GreyNoiseorganization · 5
- DeepSeekai model · 4
- OpenAIorganization · 3
- DeepSeekvendor · 3
- GreyNoisevendor · 3
- CISAorganization · 3
- OpenAIvendor · 3
- DeepSeekorganization · 3
- Codexai model · 2
- watchTowrorganization · 2
- watchTowrvendor · 2
- Huntressvendor · 2
- Cloudflarevendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.