PaperCut Flaws Exploited in Attacks on U.S. and European Schools
Attackers are chaining recently disclosed PaperCut flaws CVE-2026-81578 and CVE-2026-82078 to steal credentials and create privileged accounts at US and European schools.
Arctic Wolf researchers observed threat actors exploiting PaperCut servers via CVE-2026-81578 and CVE-2026-82078, chaining an authentication bypass with remote code execution. Post-exploitation included creating a privileged account named Administrator17, downloading credential-harvesting tools with certutil, Meterpreter Java payloads, and registry hive collection to recover the Windows BootKey and reach the SAM database. PaperCut disclosed active exploitation on August 27, 2026, and CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31. PaperCut has a history of exploitation, including attacks that delivered LockBit ransomware.
- Attackers chained authentication bypass and RCE, created privileged account Administrator17, and ran reconnaissance commands.
- Credential harvesting used certutil downloads, Meterpreter Java payloads and lsa_collect.exe registry collection.
- Attackers searched PaperCut configuration files for passwords, secrets, LDAP settings and tokens.
- PaperCut disclosed active exploitation August 27; CISA added both flaws to KEV August 31.
- Defenders urged to patch, review server.log, and keep management interfaces off the internet.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1136.001 Create Account: Local AccountT1105 Ingress Tool TransferT1003.002 Security Account ManagerT1082 System Information Discovery
- Vendors
- PaperCutArctic Wolf
- Products
- PaperCut
- Malware
- Meterpreter
- Victims
- US and European schools
- Organizations
- PaperCutArctic WolfCISALockBit
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
From the original article
2 min read at securityaffairs.com
Attackers are exploiting two new PaperCut flaws to steal credentials and gain privileged access in education-sector attacks across the U. S. and Europe.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.