Attackers are actively abusing recently disclosed high-severity vulnerabilities in PaperCut print management software to compromise credential security within schools and universities across the United States and Europe. Two flaws—CVE-2026-81578 and CVE-2026-82078—enable attackers to bypass authentication and run remote code without authorization, allowing them to execute commands, perform reconnaissance, and establish privileged accounts.
What’s happening
Security researchers at Arctic Wolf report that threat actors are leveraging these two chained flaws to infiltrate PaperCut servers. Once inside, the attackers are carrying out malicious activity that includes discovering system configuration, harvesting credentials, accessing sensitive data, and creating backdoor administrator accounts—such as one dubbed “Administrator17”.
Evidence of post-exploitation includes execution of discovery commands like uname, whoami, ver, and tasklist. Inbound HTTP GET requests to paths like /custom/pcp_*.txt and /custom/web/pcp_*.txt have been recorded, retrieving system and user data. Attackers also use built-in Windows utilities like certutil.exe to download credential-stealing tools, including lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe. Additionally, Meterpreter Java payloads are being fetched and used, and config files are searched for strings like “password,” “secret,” and “token.”
Why this matters
Attackers gaining access to registry hives can reconstruct the BootKey, which in turn allows access to the Security Accounts Manager database (SAM). That means once inside, threat actors could move laterally, compromise other connected systems, escalate privileges, or steal more credentials.
Because PaperCut servers are often exposed or reachable on the internet in educational institutions, they represent high-value targets. With the education sector already stretched thin in terms of cybersecurity resources, these kinds of vulnerabilities pose particularly serious risks.
What institutions should do now
Organizations using PaperCut should immediately ensure their servers are not accessible via the internet. Effective monitoring for execution of command interpreters—such as cmd.exe or powershell.exe—or elevated processes with suspicious children like pc-app.exe is critical. Other red flags include execution of discovery commands (e.g. whoami, tasklist, uname -a) especially when invoked by nonstandard parent processes.
Patching both CVE-2026-81578 and CVE-2026-82078 should be treated as urgent. Institutions would be well advised to isolate PaperCut systems on secure networks, restrict their access, and proactively hunt for indicators of compromise such as the previously noted executables and registry-based activity.
Though the vulnerabilities are relatively new and were only recently disclosed, the exploitation is already widespread among schools and universities in the U.S. and Europe. Observations over recent weeks indicate that attackers are rapidly incorporating these flaws into their toolchains.
Analysis: The accelerated exploitation of PaperCut’s authentication bypass and remote code execution flaws highlights a recurring pattern: attackers moving at pace to weaponize newly disclosed vulnerabilities, especially in sectors like education where cybersecurity budgets and defenses are often stretched thin. What this means going forward is clear—defenders must assume that any unfixed critical vulnerability is being exploited or will be imminently. Education IT teams should prioritize patching, visibility, and defense-in-depth, while policymakers may need to reconsider disclosure timelines, vendor obligation, and sector-wide coordination in response to threats targeting vital infrastructure like school systems.
