PaperCut Vulnerabilities Exploited to Steal Credentials From Schools and Universities

Security researchers have uncovered an ongoing campaign targeting vulnerable PaperCut NG and PaperCut MF servers. According to Arctic Wolf, attackers are chaining two vulnerabilities—CVE-2026-81578 and CVE-2026-82078—to compromise PaperCut environments and conduct post-exploitation activity.

The attacks demonstrate how a seemingly routine print-management server can become an entry point into an organization's wider IT environment.

Executive Summary

1. Threat Level: 🔴 Critical
2. Targeted Sector: Education
3. Affected Products: PaperCut NG and PaperCut MF
4. Exploitation Status: Actively exploited
5. Known Exploited Vulnerability: Yes
6. Primary Risks: Remote code execution, credential theft, privilege escalation and network reconnaissance

Arctic Wolf observed attackers executing system discovery commands, attempting to create privileged accounts, collecting Windows registry hives, and deploying tools associated with credential harvesting and post-exploitation frameworks.

Key Takeaways

• Two PaperCut vulnerabilities are being actively exploited: CVE-2026-81578 and CVE-2026-82078.
• Attackers can chain the vulnerabilities to move from unauthorized access to command execution.
• Campaigns have targeted K-12 schools and universities in the U.S. and Europe.
• Threat actors performed host and user reconnaissance after compromising PaperCut servers.
• Attackers attempted to establish persistence through the creation of a privileged account named Administrator17.
• Researchers observed tools associated with Windows credential and registry-hive collection.
• Both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog.

Affected Products

The vulnerabilities affect PaperCut NG and PaperCut MF.

Organizations running versions below the vendor's patched releases should prioritize immediate remediation. Current vulnerability research identifies patched versions as:

Organizations should verify their exact deployment version against PaperCut's security advisory before applying updates.

Vulnerabilities and CVSS Scores
CVE-2026-81578 — Authentication Bypass

Severity: High
CVSS v4.0: 8.8

The vulnerability involves improper access control in the PaperCut web management interface. It can allow unauthenticated attackers to reach administrative functionality and modify configuration. When combined with the second vulnerability, this can lead to arbitrary code execution.

Interestingly, CVSS scoring differs between versions: Tenable lists a CVSS v3.1 score of 9.8 (Critical), while the newer CVSS v4.0 rating is 8.8 (High). Organizations should therefore pay attention to the underlying exploitability and active exploitation status rather than relying solely on the severity label.

CVE-2026-82078 — Unsafe Dynamic Class Loading

**Severity: **Critical
**CVSS v4.0: **9.4

This vulnerability exists in PaperCut's database connection utilities. Under the relevant conditions, attackers can manipulate configuration parameters and cause the application to load attacker-controlled Java classes from the application classpath.

Successful exploitation can result in arbitrary Java bytecode execution under the security context of the PaperCut server.

How the Attack Works

The observed attacks follow a progression from initial compromise to credential theft and persistence.

1. Initial Access

Attackers target vulnerable PaperCut servers that can be reached over the network.

2. Authentication Bypass

CVE-2026-81578 can allow unauthorized access to administrative functionality without legitimate authentication.

3. Configuration Manipulation

The attackers manipulate relevant PaperCut configuration settings, creating the conditions needed to exploit the second vulnerability.

4. Remote Code Execution

CVE-2026-82078 can then be used to load and execute Java code on the compromised PaperCut server.

5. Reconnaissance

After gaining execution capability, attackers perform system discovery using commands such as:

• whoami
• uname
• ver
• tasklist

These commands help attackers identify the operating system, current user, running processes and characteristics of the compromised host.

6. Credential Theft and Persistence

Researchers observed activity involving Windows registry-hive collection tools and attempts to create privileged accounts. Metasploit and Meterpreter-related Java payloads were also identified.

This means the attack can progress beyond compromising the print server and potentially become a broader identity and network compromise.

Why Educational Organizations Are at Risk

Schools and universities operate large, distributed environments containing thousands of users, endpoints, servers and applications.

A compromised PaperCut server may provide attackers with an advantageous position from which to:

1. Discover internal systems
2. Identify privileged accounts
3. Search for credentials
4. Access sensitive configuration information
5. Establish persistence
6. Move laterally across the network
7. Target additional systems and services

The observed campaign demonstrates that attackers are not necessarily interested in the printing infrastructure itself. Instead, the PaperCut server can serve as an initial foothold into the wider organization.

Mitigation and Recommended Actions

Organizations using PaperCut NG or MF should treat this as a high-priority security incident, particularly where servers are internet-facing.

1. Patch Immediately

Upgrade affected PaperCut NG and MF installations to the appropriate security release. PaperCut has issued an emergency patch for these vulnerabilities.

2. Restrict Internet Exposure

Where external access is not required, remove PaperCut Application Servers from direct internet exposure.

Administrative interfaces should ideally be accessible only from trusted internal networks or through controlled remote-access mechanisms.

3. Hunt for Indicators of Compromise

Security teams should investigate PaperCut servers for:

1. Unexpected administrator accounts
2. Suspicious Java processes
3. cmd.exe or PowerShell spawned by PaperCut processes
4. Unexpected certutil.exe activity
5. Registry-hive collection tools
6. Unusual outbound connections
7. Suspicious HTTP GET requests
8. Unexpected configuration changes

4. Review Authentication Activity

Look for unusual authentication activity involving:

• Privileged accounts
• Service accounts
• Domain administrators
• Recently created local accounts
• Unusual geographic locations
• Abnormal login times

5. Rotate Potentially Exposed Credentials

If compromise is suspected, organizations should consider resetting credentials that may have been accessible from the affected system, particularly privileged and service accounts.

6. Investigate for Lateral Movement

Do not limit the investigation to the PaperCut server.

Security teams should examine:

PaperCut Server → Endpoint Activity → Credential Access → Privilege Escalation → Lateral Movement → Persistence

A compromised PaperCut server should be treated as a potential entry point into the broader environment.

Security Operations Recommendation

For SOC teams, this incident highlights the importance of monitoring application servers that are not traditionally considered security-critical infrastructure.

Detection rules should monitor for unusual child processes originating from PaperCut components, unexpected administrative account creation, suspicious Java execution, registry-hive access and outbound connections from PaperCut servers.

Organizations should also correlate PaperCut server activity with Windows authentication, endpoint detection, identity and network telemetry to identify signs of post-exploitation.

Bottom Line

The exploitation of CVE-2026-81578 and CVE-2026-82078 shows how rapidly newly disclosed vulnerabilities can transition into real-world attacks.

For schools and universities running PaperCut NG or MF, patching alone should not be the end of the response. Organizations should verify whether vulnerable systems were exposed, investigate for signs of compromise, review privileged-account activity and hunt for credential theft and lateral movement.

With both vulnerabilities actively exploited and listed in CISA's Known Exploited Vulnerabilities catalog, organizations should consider remediation an urgent security priority.