Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Attackers exploit newly disclosed PaperCut auth bypass CVE-2026-81578 and RCE CVE-2026-82078 to steal credentials from schools and universities in the US and Europe.
Arctic Wolf observed threat actors chaining CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) in PaperCut to execute commands, perform reconnaissance, and create privileged accounts on servers at K-12 schools and universities in the US and Europe. Post-exploitation includes registry hive collection with lsa_collect.exe delivered via certutil, Meterpreter Java payloads from 194.180.48.134, and searches of PaperCut config files for passwords, LDAP bindings, and tokens. Stolen logins could provide a pathway into other critical systems across compromised environments.
- Auth bypass plus RCE chain enables command execution and privileged account creation
- Credential harvesters lsa_collect.exe and save_hives.exe fetched via certutil from 45.142.193.132
- Attackers search PaperCut configs for password, secret, ldap, bind, and token strings
- Mitigations: keep PaperCut off the internet; monitor script execution under pc-app.exe
- Vendors
- PaperCutArctic Wolf
- Products
- PaperCutMetasploitMeterpreter
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 63% | KEV | KEV |
From the original article
1 min read at thehackernews.com
Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U. S. and Europe.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.