AI-Agent Campaign Exploits PaperCut NG/MF Flaws CVE-2026-81578 and CVE-2026-82078, Compromising 440+ Instances at 395 Organizations
A likely Russian-speaking actor used hundreds of autonomous AI agents (OpenAI Codex harness + a DeepSeek model) to exploit a PaperCut NG/MF authentication bypass (CVE-2026-81578) and unsafe-reflection RCE (CVE-2026-82078), compromising at least 440 instances…
PaperCut disclosed active exploitation of CVE-2026-81578 (unauthenticated authentication bypass) and CVE-2026-82078 (unsafe-reflection remote code execution) in PaperCut NG/MF on August 27, 2026, shipped emergency patches on August 28, and CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31. GreyNoise, with Blackpoint Cyber, reported that a likely Russian-speaking actor operating from IP 45.142.193.132 developed exploits in a private lab and then launched a campaign on August 31 using hundreds of autonomous AI agents built on OpenAI's Codex harness and a DeepSeek model, going from empty workspace to first real-victim RCE in under four hours and compromising 11 organizations within 26 seconds of launch. At least 440 PaperCut NG/MF instances across 395 organizations in 48 countries were compromised; education was the hardest-hit sector with 204 victims, and the US led with 98. Credentials were harvested from 280 victims, and OS or domain secrets were pulled from 147 (SecurityWeek separately reported 137 — sources disagree). Escalation paths included LSASS and registry credential harvesting, pass-the-hash, noPac (CVE-2021-42278/CVE-2021-42287), and rogue Domain Admin accounts, with DCSync used to exfiltrate full NTDS.DIT credential dumps. Domain admin was reached at 12 organizations, with the fastest escalation in five minutes and a US high school fully compromised in seven minutes. Earlier Arctic Wolf incident observations described creation of a privileged 'Administrator17' account, certutil downloads, Meterpreter Java payloads, lsa_collect.exe registry collection, and searches of PaperCut configuration files for passwords, secrets, LDAP settings and tokens. Some agents ignored the operator's 28-country do-not-target list (which included Russia, China, Hong Kong, Thailand and Iran) and still compromised victims in Russia, China, Kazakhstan and Pakistan; at least one attack was blocked by Cloudflare WAF. PaperCut has since released maintenance versions 26.0.5, 25.0.13 and 24.1.10 superseding Emergency Patch Releases 1-3. The actor's end goal is unclear — possible access sale or ransomware follow-on — though past PaperCut intrusions led to LockBit ransomware and extortion.
- Vulnerabilities: CVE-2026-81578 (unauthenticated authentication bypass) and CVE-2026-82078 (unsafe-reflection RCE) in PaperCut NG/MF; exploitation disclosed August 27, 2026, emergency-patched August 28, added to CISA KEV August 31.
- Scale: at least 440 PaperCut NG/MF instances compromised across 395 organizations in 48 countries; campaign launched August 31, 2026.
- Actor: likely Russian-speaking, originating from IP 45.142.193.132 (second IOC: 45.158.196.75); built target lists using a compromised Netlas.io API key and rehearsed exploits in a self-hosted lab.
- AI automation: hundreds of agents on OpenAI's Codex harness with a DeepSeek model; empty workspace to first RCE in under four hours; 11 organizations compromised within 26 seconds once the campaign launched.
- Impact: credentials harvested from 280 victims; OS or domain secrets pulled from 147 (SecurityWeek reported 137 — sources disagree); domain admin achieved at 12 organizations; fastest escalation to domain admin five minutes; a US high…
- Targeting: education hardest hit with 204 victims; US led with 98, followed by the UK, France, Spain and Canada.
- Attack paths: LSASS/registry credential harvesting, pass-the-hash, noPac (CVE-2021-42278/CVE-2021-42287), and rogue Domain Admin accounts; DCSync used to dump full NTDS.DIT credentials.
- Tooling: Mimikatz, SharpHound, Certipy, Rubeus, Impacket, Metasploit/Meterpreter, Ligolo tunneling, and certutil Base64 encoding for exfiltration; GreyNoise published IOCs including Rust LSA tools and staged hive paths.
Coverage timelineoldest first · each row is one article
- · 11d agoPaperCut Flaws Exploited in Attacks on U.S. and European Schools
Security Affairs· 75
Attackers are chaining recently disclosed PaperCut flaws CVE-2026-81578 and CVE-2026-82078 to steal credentials and create privileged accounts at US and European schools.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-42287 +1 in the same advisory: …42278 | Privilege Escalation in Microsoft Active Directory Domain Services CVE-2021-42287 is an elevation-of-privilege vulnerability in Microsoft Active Directory Domain Services (AD DS) affecting multiple supported Windows Server releases. An attacker with any low-privileged domain account can trigger it — commonly in combination with the related sAMAccountName spoofing flaw CVE-2021-42278 — by manipulating account name attributes so the Kerberos Key Distribution Center issues tickets that grant rights normally reserved for domain controllers. The result is escalation from a standard user to domain administrator, giving the attacker full control over the Windows domain, a capability that is directly useful for ransomware deployment and data theft. Any organization running Active Directory on the affected Windows Server versions is exposed, which amounts to essentially every enterprise Windows network. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11 with known ransomware use, and EPSS assigns it a 77.2% probability of exploitation within 30 days. Do: Apply Microsoft's security updates to every domain controller — writable and read-only — as soon as possible (the fix shipped in Microsoft's November 2021 security releases), prioritizing internet-exposed and VPN-facing DCs. Hunt domain controller logs for anomalous Kerberos TGT requests by user accounts with domain-controller-style names (a hallmark of CVE-2021-42278/42287 abuse) and monitor for ransomware staging activity, given documented ransomware use. | 7.5 | 77% | KEV ransomware |
| masswell over 100,000 Windows Server domain controllers and millions of domain users worldwide | |
| CVE-2026-82078 +1 in the same advisory: …81578 | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile). Do: Upgrade PaperCut NG and MF to the patched release specified in PaperCut's security advisory (exact fixed versions were not provided in this data), prioritizing internet-exposed print servers; the KEV listing means agencies must remediate per CISA BOD 26-04 or discontinue/mitigate per its cloud-service guidance. Restrict the PaperCut web interface from direct internet exposure (VPN/allowlist), review administrator accounts and database driver configuration for tampering, and hunt for post-exploitation activity, since this flaw is being actively chained with the authentication bypass CVE-2026-81578. | 9.4 group max | 4% | KEV |
| mass≈100,000+ organizations / plausibly millions of end users (vendor-cited install base); tens of thousands of on-prem servers with a smaller but significant… |