Exploitation of PaperCut Vulnerabilities (CVE‑2026‑81578, CVE‑2026‑82078) Enables Credential Theft in U.S. and European Schools

Exploitation of PaperCut Vulnerabilities (CVE‑2026‑81578, CVE‑2026‑82078) Enables Credential Theft in U.S. and European Schools

What It Is – Two newly disclosed PaperCut Server flaws (CVE‑2026‑81578, CVE‑2026‑82078) allow an authentication bypass that can be chained to remote‑code execution. Attackers have used the chain to run commands, harvest Windows registry hives, and create privileged accounts on school networks.

Exploitability – Publicly disclosed on 27 Aug 2026; CISA added both to its Known Exploited Vulnerabilities catalog on 31 Aug 2026. Threat‑intel reports confirm active exploitation in the wild, with Metasploit‑based payloads observed.

Affected Products – PaperCut MF / NG server versions vulnerable to the two CVEs (specific version numbers disclosed in the vendor advisory).

Why It Matters for Trust & Control Assurance

• Access‑control hygiene – The bypass demonstrates that weak authentication controls can be subverted, underscoring the need for continuous verification of privileged‑account provisioning.
• Audit‑ready logging – Post‑exploitation activity (creation of “Administrator17”, registry‑hive collection, unusual .class/.cmd/.out files) provides concrete evidence that can be captured and correlated to satisfy control‑monitoring requirements.
• Defensible remediation – Demonstrating that the PaperCut management interface is removed from the public Internet and that patches are applied becomes a tangible control artifact for auditors and enterprise buyers.

Recommended Actions

1. Apply PaperCut’s security patches for CVE‑2026‑81578 and CVE‑2026‑82078 immediately.
2. Harden the management interface: block public Internet access, enforce MFA, and restrict IP ranges to known administrative networks.
3. Enable detailed logging of pc-app.exe, PowerShell/Command‑Prompt invocations, and creation of new local accounts; forward logs to a SIEM for continuous monitoring.
4. Search existing server logs for the indicators listed by Arctic Wolf (e.g., .class files, /custom/pcp_*.txt requests, large Python‑requests downloads).
5. Conduct a rapid credential‑rotation for any accounts discovered in PaperCut configuration files or LDAP bindings.

Source: Security Affairs – PaperCut Flaws Exploited in Attacks on U.S. and European Schools