Attackers are moving fast on the latest PaperCut NG/MF vulnerabilities, and the pattern matters well beyond schools. PaperCut sits in the uncomfortable middle of identity, print infrastructure, directory services, device fleets, and internal administrative workflows. When that kind of server is exposed or poorly segmented, it becomes more than a print-management issue: it becomes a credential and privilege-access problem.

Security Affairs reported that attackers are exploiting CVE-2026-81578 and CVE-2026-82078 in attacks against U.S. and European education organizations. The reporting cites Arctic Wolf observations of threat actors chaining authentication bypass and remote code execution to run commands, perform host reconnaissance, create privileged accounts, and look for credential material.

What happened

The attack chain combines two PaperCut NG/MF issues:

  • CVE-2026-81578 — an improper access-control flaw in the web management interface that can let an unauthenticated attacker alter system configuration.
  • CVE-2026-82078 — unsafe dynamic class loading in database connection utilities that can be abused to execute arbitrary Java bytecode.

Huntress described the chain as pre-authentication RCE against the PaperCut Application Server. PaperCut has also published an urgent vendor advisory and emergency releases. If PaperCut is present in the environment, this should be treated as an active compromise-review event, not just a normal patch ticket.

Why this matters for SMBs and government contractors

Print infrastructure is often treated as boring middleware. That is exactly why it is dangerous. These systems frequently talk to Active Directory, LDAP, email, file shares, databases, and end-user workstations. They may also be managed by a small IT team, a school district MSP, or a vendor who only logs in when something breaks.

For small businesses, municipalities, schools, healthcare offices, and government contractors, the operational risk is straightforward: an exposed PaperCut server can give an attacker an internal foothold that blends into normal administrative traffic. Once code execution is achieved, the next steps are predictable — reconnaissance, credential harvesting, privileged account creation, and lateral movement.

Defensive actions to take now

  • Patch immediately. Follow PaperCut’s current advisory and install the latest emergency release that supersedes prior fixes.
  • Remove public exposure. PaperCut management interfaces should not be reachable from the internet. Put access behind a VPN, private access broker, or tightly scoped administrative network.
  • Review server logs. Look for unusual command execution, suspicious Java class files, requests to custom PaperCut paths, and evidence of server.log tampering or deletion.
  • Hunt for child processes. Investigate PaperCut processes launching cmd.exe, powershell.exe, shell utilities, scripting runtimes, or download tools.
  • Audit privileged accounts. Check for newly created local administrators, unexpected service accounts, or accounts with names that look slightly legitimate.
  • Search for credential access. Review signs of registry hive collection, LDAP configuration access, database credential access, and attempts to read PaperCut configuration files.
  • Segment print services. Print management servers should have explicit allowlists for directory, database, mail, logging, and printer communication — not broad east-west access.

Bulwark Black assessment

The most important lesson is not “patch PaperCut,” although that is the first action. The larger lesson is that internal management platforms need the same exposure control and detection coverage as VPNs, firewalls, identity providers, and RMM tools.

If a system can change directory-connected workflows, hold credentials, reach many endpoints, or run administrative code, it deserves tiered access, centralized logging, egress controls, and a tested compromise playbook. Print servers are still servers. Treat them that way.

Source: Security Affairs — PaperCut flaws exploited in attacks on U.S. and European schools

Additional references: Huntress technical analysis and PaperCut urgent security advisory.