ATTACKERS are exploiting two recently disclosed PaperCut flaws to credentials and gain privileged access in education-sector networks across the United States and Europe. The flaws, CVE-2026-81578 and CVE-2026-82078, enable a sequence of authentication bypass and remote code execution against PaperCut servers, allowing attackers to perform reconnaissance and create privileged accounts.
Arctic Wolf researchers observed post‑exploitation activity that included delivering Windows registry hive collection tools, Metasploit/Meterpreter‑related Java payloads, and commands to identify hosts, users, processes and sensitive configuration data. PaperCut disclosed active exploitation on 27 August 2026, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 31 August 2026.
In observed campaigns, attackers used PaperCut to run basic system checks, create a privileged account named Administrator17, and extract data from the system. They downloaded credential‑harvesting tools with certutil and used Meterpreter Java payloads to establish remote sessions, while also inspecting PaperCut configuration files for passwords, secrets, LDAP settings and tokens.
Researchers noted lsa_collect.exe extracting registry keys to recover the Windows BootKey, a step that could facilitate access to the SAM database and stored credentials. Defenders are urged to correlate indicators with PaperCut server logs, watch for unusual five‑character .class, .cmd or .out files, and monitor pc-app[.]exe for shells such as cmd[.]exe and powershell[.]exe.
Look for commands like whoami, tasklist, ver and uname, credential‑harvesting tools, unexpected privileged accounts (notably Administrator17), and large downloads via python‑requests. Finally, ensure PaperCut management interfaces are not exposed on the public Internet and apply vendor security fixes.