Attackers are actively exploiting two recently disclosed vulnerabilities in PaperCut, an enterprise print management platform, to compromise educational institutions across the United States and Europe. The flaws, identified as CVE-2026-81578 and CVE-2026-82078, allow for credential theft and elevated access.
PaperCut officially acknowledged active exploitation of these vulnerabilities on August 27, 2026. Subsequently, on August 31, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities catalog, underscoring the immediate threat they pose.
Researchers from Arctic Wolf observed threat actors chaining an authentication bypass with remote code execution. This combination enabled attackers to execute commands, conduct reconnaissance within compromised networks, and create new privileged accounts.
Post-exploitation activities included the deployment of tools designed to collect Windows registry hives and Java payloads associated with Metasploit/Meterpreter. Attackers used these to identify hosts, users, processes, and sensitive configuration data.
Specific observed actions included running basic system checks, creating a privileged account named "Administrator17," and gathering system and user data. Attackers also downloaded credential-harvesting tools using `certutil` and utilized Meterpreter Java payloads to establish remote sessions.
Further analysis revealed attackers searching PaperCut configuration files for sensitive information such as passwords, secrets, LDAP settings, and tokens. Researchers also noted the use of `lsa_collect.exe` to extract registry keys, specifically to recover the Windows BootKey, which could grant access to the Security Account Manager (SAM) database and stored credentials.
Organizations using PaperCut are advised to review their `PaperCut server.log` files for indicators of compromise. These indicators include unusual five-character files with `.class`, `.cmd`, or `.out` extensions. Monitoring `pc-app.exe` for unexpected command shells like `cmd.exe` and `powershell.exe`, and investigating commands such as `whoami`, `tasklist`, `ver`, and `uname` is also recommended.
Defenders should also look for the presence of credential-harvesting tools, any unexpected privileged accounts like "Administrator17," suspicious requests to `/custom/pcp_*.txt`, and large downloads initiated by `python-requests`. As a general security measure, PaperCut management interfaces should not be exposed to the public internet, and all available security fixes from the vendor should be promptly installed.
PaperCut has a history of being targeted in cyberattacks, including previous incidents that led to the deployment of LockBit ransomware. The rapid exploitation of these latest flaws highlights the critical need for organizations to apply patches for newly disclosed vulnerabilities without delay.
