AI‑Powered Campaign Exploits PaperCut Vulnerabilities, Compromising 395 Organizations
What Happened — A Russian‑speaking threat group deployed hundreds of AI agents to automatically develop, test, and launch exploits for CVE‑2026‑81578 and CVE‑2026‑82078 in PaperCut NG/MF servers. Between August 31 and early September 2026 the campaign breached at least 440 PaperCut instances belonging to 395 distinct organizations in 48 countries, harvesting credentials from 280 victims and obtaining domain‑admin rights in 12 cases.
Why It Matters for Trust & Control Assurance
- Demonstrates how automated vulnerability exploitation can bypass traditional patch‑cycle timelines, stressing the need for continuous vulnerability‑management controls that generate real‑time evidence of remediation.
- Highlights the importance of auditable credential‑access monitoring (e.g., pass‑the‑hash, DCSync detection) as a control‑assurance artifact that can be presented during audits.
- Shows that a single unpatched component can cascade into enterprise‑wide privilege escalation, underscoring the value of a control‑mapping program that ties each vulnerability to multiple framework objectives.
Who Is Affected – Primarily education institutions (≈ 50 % of victims), but also health, government, and private‑sector organizations that run PaperCut print‑management servers.
Recommended Actions
- Verify that all PaperCut NG/MF deployments are patched to the versions addressing CVE‑2026‑81578 and CVE‑2026‑82078.
- Deploy continuous vulnerability‑scanning and automated patch‑validation to capture evidence of remediation.
- Enable and log privileged‑account activity (LSASS dumps, DCSync, pass‑the‑hash) and integrate logs into a SIEM for rapid detection.
- Conduct a credential‑hygiene review: rotate service‑account passwords, enforce least‑privilege, and disable unnecessary domain‑admin memberships.
- Map the remediation steps to your control framework using a centralized Trust Center to produce defensible audit evidence.
Technical Notes – The attackers combined OpenAI Codex and DeepSeek models with commodity tools (Ligolo‑ng, Mimikatz, Certipy, BloodHound, Rubeus, Impacket) to generate exploits for the two CVEs, then used “noPac” and DCSync techniques to harvest domain credentials. The campaign achieved initial RCE in under four hours and domain‑admin compromise in as little as seven minutes. Source: BleepingComputer