Attackers Target Education Sector via PaperCut Vulnerabilities CVE-2026-81578 and…

Threat actors are actively exploiting a critical PaperCut vulnerability chain to hijack print servers, harvest credentials, and pivot into internal networks across K-12 schools and major universities in the United States and Europe. The attack relies on pairing CVE-2026-81578, an authentication bypass weakness categorized under CWE-305, with CVE-2026-82078, a remote code execution flaw. Together, these flaws allow unauthenticated attackers to execute arbitrary system commands over the network without requiring user interaction.

The primary bug in the chain, CVE-2026-81578, carries a CVSS v3.1 score evaluated with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Although EPSS models assigned the flaw a 1.6% 30-day probability of exploitation (placing it in the 74th percentile of monitored CVEs), real-world activity has escalated rapidly following public disclosure and the release of weaponized Metasploit framework modules. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.

Exploitation Mechanics and Post-Compromise Activity

Observation of threat actor behavior by Arctic Wolf’s Adversary Research Team indicates that attackers leverage the authentication bypass to interact directly with the PaperCut application core process (pc-app.exe). Once initial command execution is achieved, the attackers execute system discovery commands including whoami, tasklist, ver, and uname to map the environment and assess process privileges.

Following initial discovery, the threat actors execute a multi-stage post-exploitation routine focused on persistent access and credential theft:

• Account Creation: Attackers establish localized administrative backdoors on target hosts, specifically creating elevated user accounts such as Administrator17.
• Configuration Harvesting: Using native tools like findstr, attackers search PaperCut configuration files (*.config) for high-value sensitive strings, targeting cleartext or reversible entries containing password, secret, ldap, bind, and token.
• Payload Staging: Compromised hosts issue HTTP GET requests to 45.142.193[.]132 to download credential extraction tools—such as lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe—using the native Windows utility certutil.exe.
• Memory & SAM Exfiltration: Attackers extract specific registry keys to reconstruct the system BootKey, allowing them to decrypt and parse the local Security Account Manager (SAM) database and Local Security Authority (LSA) secrets. Output files containing harvested data are stored in /custom/pcp_*.txt and /custom/web/pcp_*.txt web directories for staged exfiltration.
• C2 Persistence: Attackers retrieve Java-based Meterpreter payloads from 194.180.48[.]134, establishing interactive command-and-control sessions back to the infrastructure.

Blast Radius and Vulnerability Exposure

Print management platforms like PaperCut MF and PaperCut NG present a high-risk attack surface because they frequently interface directly with central directory services—such as Microsoft Active Directory or LDAP servers—to handle user authentication and print quota management. Furthermore, educational institutions routinely expose these portals to public networks or broad campus Wi-Fi networks to enable self-service printing for students and staff.

When an attacker compromises a PaperCut application server, the blast radius extends far beyond print infrastructure. Obtaining system-level execution on the PaperCut server combined with extracted LDAP bind credentials provides attackers with valid entry points into central identity infrastructure. With active directory bind tokens and local SAM database dumps in hand, threat actors can escalate privileges domain-wide, move laterally into administrative databases, and stage secondary payloads such as ransomware.

Affected Versions

PaperCut released security updates addressing these vulnerabilities in late August 2026. Environments running the following version branches remain vulnerable until patched:

• PaperCut MF and PaperCut NG 24.x: Versions prior to 24.1.9
• PaperCut MF and PaperCut NG 25.x: Versions 25.0.2 through 25.0.11 (fixed in 25.0.12)
• PaperCut MF and PaperCut NG 26.x: Versions 26.0.2 through 26.0.3 (fixed in 26.0.4)

Remediation and Threat Hunting

Organizations operating PaperCut MF or NG should immediately audit their print infrastructure and implement the following defensive actions:

1. Apply Security Patches: Upgrade installed instances immediately to fixed builds: 24.1.9, 25.0.12, or 26.0.4 or later, depending on the active release branch.
2. Restrict Application Exposure: Remove PaperCut management portals from public internet access. If external user printing is required, enforce access strictly through a Zero Trust Network Access (ZTNA) broker or VPN.
3. Inspect Endpoint Telemetry: Query endpoint detection and response (EDR) platforms for instance execution where pc-app.exe acts as the parent process spawning cmd.exe, powershell.exe, or certutil.exe. Search for commands invoking whoami, tasklist, ver, or findstr targeting *.config files.
4. Block Known Indicators of Compromise (IoCs): Filter outbound and inbound traffic at perimeter firewalls for IP addresses 45.142.193[.]132 and 194.180.48[.]134. Inspect web server logs for requests directed at /custom/pcp_*.txt or /custom/web/pcp_*.txt.
5. Credential Rotation: If signs of unauthorized access are identified on a PaperCut server, immediately rotate all LDAP bind account passwords, domain service credentials stored within the application, and local administrator passwords across affected systems.