ARCTIC Wolf’s Adversary Research Team warned that threat actors are actively exploiting CVE-2026-81578 and CVE-2026-82078 in PaperCut deployments to facilitate credential theft and post‑exploitation activity in education sector networks across the US and Europe. The two flaws form an authentication bypass and a remote code execution chain, enabling attackers to perform command execution and reconnaissance and to create privileged accounts on vulnerable PaperCut servers.
The researchers observed post‑exploitation activity that included delivering Windows registry hive collection tools, Metasploit/Meterpreter‑related Java payloads, and commands to identify hosts, users, processes and sensitive configuration data. The activity has been linked to vulnerable PaperCut servers servicing a range of educational organisations from K‑12 schools to large universities.
Evidence from Arctic Wolf’s observations details several concrete malicious actions, such as running discovery commands (uname, whoami, ver, tasklist) and the creation of a high‑privilege account (“Administrator17”). Inbound GET requests from a specific external IP range requesting files like /custom/pcp_*.txt on compromised hosts were used to harvest system and user data.
Attackers also delivered credential‑harvesting tools via certutil[.]exe, retrieved Meterpreter Java payloads, and used findstr to search PaperCut config files for terms like password, secret, ldap, bind, and token. Arctic Wolf emphasised that stolen logins could provide attackers a pathway into other critical systems.
Practical response guidance includes restricting PaperCut servers from exposure to the internet and monitoring for cmd[.]exe/powershell[.]exe activity, and for commands such as whoami, tasklist, ver, or uname -a where pc-app[.]exe is the parent process.