CVE-2026-81578
Known exploited · CISA KEV
CISA federal remediation date Sep 11
Vulnerabilities · 32 days ago
PaperCut has now split the active attack on PaperCut NG and PaperCut MF into two CVEs, CVE-2026-81578 and CVE-2026-82078, and shipped emergency fixes for versions 25 and 26. The vendor says it has confirmed customer incidents and is still treating all NG/MF versions as potentially affected.
The chain starts with unauthenticated access to privileged PaperCut functions, then uses a database-lookup path that can be turned into code execution. PaperCut’s indicators of compromise point to post-exploitation activity from pc-app.exe and missing, truncated, or deleted server.log files, which means the box may already be compromised and logging may no longer be trustworthy.
For teams with PaperCut Application Servers on the internet, the exposure is at the management layer: patching may close the bug, but it does not by itself prove the server was clean before the fix landed. The remaining question is how much attacker activity is already sitting on exposed servers, especially in education, government, and enterprise estates.
Known exploited · CISA KEV
CISA federal remediation date Sep 11
Known exploited · CISA KEV
CISA federal remediation date Sep 11
12 sources covering this story
AI agents exploited PaperCut flaws to breach 395 organizations - Help Net Security
AI agents ran a global attack on PaperCut NG/MF, breaching 440 servers in 48 countries, some in under 30 seconds.
PaperCut Flaws Exploited in AI-Powered Attacks
A Russian threat actor used AI to build, test, and deploy exploits against hundreds of organizations worldwide.
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut releases maintenance updates replacing emergency patches for two actively exploited flaws used to break into at least 395 organizations.
Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script
Human operator: don't touch CIS orgs. AI agents: look a squirrel!
AI-powered attack exploited PaperCut flaws to hack 395 organizations
A threat actor, likely Russian-speaking, used hundreds of AI agents to develop and launch a global exploitation campaign targeting vulnerable PaperCut NG/MF servers.
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
A suspected Russian-speaking actor used AI-assisted workflows to exploit PaperCut flaws and compromise at least 440 instances worldwide.
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
GreyNoise breaks down the AI-enabled campaign against PaperCut NG/MF that hit 440 instances across 48 countries.
Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Attackers exploit two PaperCut flaws to steal credentials from U.S.
PaperCut Exploitation Escalates to Active Intrusions
CISA has added the vulnerabilities tracked as CVE-2026-82078 and CVE-2026-81578 to its KEV catalog.
Attackers plant remote access tools on compromised PaperCut servers - Help Net Security
The threat actor targeting internet-facing PaperCut Application Servers is covertly installing legitimate remote access software on them.
PaperCut issues emergency patches as threat actors target chained vulnerabilities
The print management software maker faced a wave of attacks in 2023 aimed at higher education customers.
PaperCut: rilevato sfruttamento in rete delle CVE-2026-82078 e CVE-2026-81578
Rilevato lo sfruttamento attivo in rete delle vulnerabilità CVE-2026-82078 e CVE-2026-81578 – già sanate dal vendor – presenti nei prodotti PaperCut NG e PaperCut MF, soluzioni software per la gestione e il controllo delle stampe.
Part of the PlainSec briefing for 2026-09-01