Vulnerabilities & Exploits · Zero-Day Exploit
PaperCut’s Exploit Chain Splits Into Two CVEs PaperCut has now split the active attack on PaperCut NG and PaperCut MF into two CVEs, CVE-2026-81578 and CVE-2026-82078 , and shipped emergency fixes for versions 25 and 26. The vendor says it has confirmed customer incidents and is still treating all NG/MF versions as potentially affected.
The chain starts with unauthenticated access to privileged PaperCut functions, then uses a database-lookup path that can be turned into code execution. PaperCut’s indicators of compromise point to post-exploitation activity from pc-app.exe and missing, truncated, or deleted server.log files, which means the box may already be compromised and logging may no longer be trustworthy.
For teams with PaperCut Application Servers on the internet, the exposure is at the management layer: patching may close the bug, but it does not by itself prove the server was clean before the fix landed. The remaining question is how much attacker activity is already sitting on exposed servers, especially in education, government, and enterprise estates.
12 sources · Sep 11
NVD KEV
Known exploited · CISA KEV
CISA federal remediation date Sep 11
NVD KEV
Known exploited · CISA KEV
CISA federal remediation date Sep 11
Timeline Sources Sep 11 Help Net Security
AI agents exploited PaperCut flaws to breach 395 organizations - Help Net Security
AI agents ran a global attack on PaperCut NG/MF, breaching 440 servers in 48 countries, some in under 30 seconds.
original Sep 11 SecurityWeek
PaperCut Flaws Exploited in AI-Powered Attacks
A Russian threat actor used AI to build, test, and deploy exploits against hundreds of organizations worldwide.
original Sep 11 The Hacker News
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut releases maintenance updates replacing emergency patches for two actively exploited flaws used to break into at least 395 organizations.
original Part of the PlainSec briefing for 2026-09-01
Every edition of this story: PaperCut’s Exploit Chain Splits Into Two CVEs
More from today Vulnerabilities & Exploits · Zero-Day Exploit
PaperCut’s Exploit Chain Splits Into Two CVEs PaperCut has now split the active attack on PaperCut NG and PaperCut MF into two CVEs, CVE-2026-81578 and CVE-2026-82078 , and shipped emergency fixes for versions 25 and 26. The vendor says it has confirmed customer incidents and is still treating all NG/MF versions as potentially affected.
The chain starts with unauthenticated access to privileged PaperCut functions, then uses a database-lookup path that can be turned into code execution. PaperCut’s indicators of compromise point to post-exploitation activity from pc-app.exe and missing, truncated, or deleted server.log files, which means the box may already be compromised and logging may no longer be trustworthy.
For teams with PaperCut Application Servers on the internet, the exposure is at the management layer: patching may close the bug, but it does not by itself prove the server was clean before the fix landed. The remaining question is how much attacker activity is already sitting on exposed servers, especially in education, government, and enterprise estates.
12 sources · Sep 11
NVD KEV
Known exploited · CISA KEV
CISA federal remediation date Sep 11
NVD KEV
Known exploited · CISA KEV
CISA federal remediation date Sep 11
Timeline Sources Sep 11 Help Net Security
AI agents exploited PaperCut flaws to breach 395 organizations - Help Net Security
AI agents ran a global attack on PaperCut NG/MF, breaching 440 servers in 48 countries, some in under 30 seconds.
original Sep 11 SecurityWeek
PaperCut Flaws Exploited in AI-Powered Attacks
A Russian threat actor used AI to build, test, and deploy exploits against hundreds of organizations worldwide.
original Sep 11 The Hacker News
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut releases maintenance updates replacing emergency patches for two actively exploited flaws used to break into at least 395 organizations.
original Part of the PlainSec briefing for 2026-09-01
Every edition of this story: PaperCut’s Exploit Chain Splits Into Two CVEs
More from today