PaperCut Flaws Exploited in AI-Powered Attacks
GreyNoise says a Russian-speaking actor used AI to build and deploy exploits hitting 440 PaperCut NG/MF deployments across 395 organizations in 48 countries.
Two PaperCut NG/MF zero-days, CVE-2026-82078 and CVE-2026-81578, disclosed August 27 and patched August 28, enable unauthenticated authentication bypass and remote code execution. GreyNoise observed a Russian-speaking threat actor using AI to orchestrate attacks against 440 deployments in 48 countries, including 204 education-sector organizations, achieving domain admin at 12 victims. Attack paths included harvesting LSASS memory and registry secrets, mounted NoPac attacks, and adding accounts to Domain Admins, with AI automation shortening compromises to minutes or seconds.
- CVE-2026-82078 and CVE-2026-81578 allow unauthenticated bypass and code execution
- 440 deployments attacked in 48 countries; 204 were education organizations
- Credential harvesting ran on 280 hosts; secrets exfiltrated from 137
- Domain admin achieved at 12 organizations; AI cut compromise times to seconds
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1003.001 LSASS MemoryT1552.002 Credentials in RegistryT1068 Exploitation for Privilege EscalationT1136.002 Create Account: Domain Account
- Products
- PaperCut NGPaperCut MF
- Threat actors
- Russian-speaking threat actor
- Countries
- 48 countries
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
From the original article
2 min read at securityweek.com
A Russian threat actor used AI to build, test, and deploy exploits against hundreds of organizations worldwide. The post PaperCut Flaws Exploited in AI-Powered Attacks appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.