PaperCut Flaws Exploited in Attacks on U.S. and European Schools
Attackers are chaining recently disclosed PaperCut flaws CVE-2026-81578 and CVE-2026-82078 to steal credentials and create privileged accounts at US and European schools.
Arctic Wolf researchers observed threat actors exploiting PaperCut servers via CVE-2026-81578 and CVE-2026-82078, chaining an authentication bypass with remote code execution. Post-exploitation included creating a privileged account named Administrator17, downloading credential-harvesting tools with certutil, Meterpreter Java payloads, and registry hive collection to recover the Windows BootKey and reach the SAM database. PaperCut disclosed active exploitation on August 27, 2026, and CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31. PaperCut has a history of exploitation, including attacks that delivered LockBit ransomware.
- Attackers chained authentication bypass and RCE, created privileged account Administrator17, and ran reconnaissance commands.
- Credential harvesting used certutil downloads, Meterpreter Java payloads and lsa_collect.exe registry collection.
- Attackers searched PaperCut configuration files for passwords, secrets, LDAP settings and tokens.
- PaperCut disclosed active exploitation August 27; CISA added both flaws to KEV August 31.
- Defenders urged to patch, review server.log, and keep management interfaces off the internet.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-82078 +1 in the same advisory: …81578 | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile). Do: Upgrade PaperCut NG and MF to the patched release specified in PaperCut's security advisory (exact fixed versions were not provided in this data), prioritizing internet-exposed print servers; the KEV listing means agencies must remediate per CISA BOD 26-04 or discontinue/mitigate per its cloud-service guidance. Restrict the PaperCut web interface from direct internet exposure (VPN/allowlist), review administrator accounts and database driver configuration for tampering, and hunt for post-exploitation activity, since this flaw is being actively chained with the authentication bypass CVE-2026-81578. | 9.4 group max | 2% | KEV |
| mass≈100,000+ organizations / plausibly millions of end users (vendor-cited install base); tens of thousands of on-prem servers with a smaller but significant… |
Full article367 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 05, 2026
Attackers are exploiting two new PaperCut flaws to steal credentials and gain privileged access in education-sector attacks across the U.S. and Europe.
Attackers are exploiting two recelty disclosed PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, in attacks targeting schools and other education organizations in the U.S. and Europe, as reported by TheHackerNews.
Arctic Wolf researchers observed threat actors chaining an authentication bypass with remote code execution to run commands, perform reconnaissance and create privileged accounts. The activity shows how quickly attackers can turn newly disclosed vulnerabilities into real-world attacks, putting sensitive credentials and systems at risk.
“Arctic Wolf observed exploitation of PaperCut servers affected by CVE-2026-81578 and CVE-2026-82078 leading to command execution, reconnaissance, and attempts to create privileged accounts.” reads the advisory. “Observed post-exploitation activity included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, and commands used to identify hosts, users, processes, and sensitive configuration data.”
PaperCut, an enterprise print-management platform, has a history of exploitation, including attacks that delivered LockBit ransomware. PaperCut disclosed active exploitation of the latest flaws on August 27, 2026. CISA added both to its Known Exploited Vulnerabilities catalog on August 31.
Attackers used PaperCut flaws to run basic system checks, create a privileged account named Administrator17, and collect system and user data.
They downloaded credential-harvesting tools with certutil and used Meterpreter Java payloads to establish remote sessions. The attackers also searched PaperCut configuration files for passwords, secrets, LDAP settings and tokens.
Researchers observed lsa_collect.exe extracting registry keys to recover the Windows BootKey, which could give attackers access to the SAM database and stored credentials.
Defenders should review PaperCut server.log files for known exploitation indicators and look for unusual five-character .class, .cmd, or .out files. Monitor pc-app.exe for command shells such as cmd.exe and powershell.exe, and investigate commands like whoami, tasklist, ver, and uname.
Also check for credential-harvesting tools, unexpected privileged accounts such as Administrator17, suspicious requests to /custom/pcp_*.txt, and large downloads using python-requests.
Finally, keep PaperCut management interfaces off the public internet and install the vendor’s security fixes.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, PaperCut)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/198476/hacking/papercut-flaws-exploited-in-attacks-on-u-s-and-european-schools.html