Critical PaperCut CVE-2023-27350 Exploited on 440 Servers

Key Takeaways

• A sophisticated cybercrime operation leveraged AI agents to compromise hundreds of internet-exposed PaperCut NG and MF print management servers.
• At least 440 server instances across 48 countries, linked to 395 organizations, were successfully breached.
• The attacks exploited two critical vulnerabilities (CVE-2026-81578 and CVE-2026-82078) in PaperCut NG/MF software.
• The campaign demonstrated rapid progression from initial access to domain administrator privileges, often within hours.
• Organizations are strongly advised to patch their PaperCut installations immediately and investigate for signs of prior compromise.

A sophisticated cybercrime operation, orchestrating hundreds of AI agents, has targeted internet-facing PaperCut NG and MF print-management servers, successfully compromising at least 440 instances across 395 organizations in 48 countries. This extensive campaign, detailed by GreyNoise, highlights a new frontier in automated exploitation.

The attackers ingeniously combined OpenAI’s Codex coding agent with a DeepSeek model, along with conventional security tools. This hybrid approach enabled them to rapidly develop and refine exploits before deploying them at scale against vulnerable systems, according to GreyNoise’s analysis.

While the incident underscores the potential for AI agents to accelerate complex intrusion processes, the ultimate success of the breaches hinged on the presence of vulnerable or inadequately protected systems. Researchers observed that compromised print servers were subsequently utilized to harvest credentials and establish footholds within internal networks.

In a later investigation, analysts at Hunt.io identified exposed attacker directories. These directories contained a treasure trove of operational data, including agent instructions, exploit code, detailed logs, credential harvesting tools, and files that meticulously documented the campaign’s development and execution.

The core of the campaign revolved around exploiting two specific vulnerabilities in PaperCut NG/MF: CVE-2026-81578, which permits unauthenticated requests to modify specific settings, and CVE-2026-82078, an unsafe class-loading flaw that facilitates code execution once an attacker can alter those settings.

Hackers Use Codex and DeepSeek AI Agents

These two vulnerabilities, when chained together, provide a clear path for an attacker to achieve remote code execution on a vulnerable server. PaperCut has released security maintenance updates to address these issues, specifically versions 26.0.5, 25.0.13, and 24.1.10. Organizations are urged to consult the vendor’s advisory for detailed upgrade guidance.

GreyNoise reported that the malicious activity commenced on August 31, 2026, with the threat actor initially using a self-hosted lab environment to rigorously test and refine their exploit code.

Following successful testing, the campaign transitioned from development to active targeting. GreyNoise noted an astonishing pace: the operator gained initial access to a live system in under four hours, achieved domain administrator privileges just two hours later, and then compromised 11 organizations within a mere 26 seconds once the broader attack commenced.

It is important to clarify that these figures represent observed activity and do not necessarily imply that every targeted system was fully breached or that every compromise resulted in the same level of access.

This news follows earlier reports by Cyber Security News concerning the extensive use of AI agents to target PaperCut flaws, emphasizing the campaign’s reliance on automation for rapid and widespread exploitation.

Hunt.io’s subsequent review provided critical insights gleaned directly from the attacker’s exposed operational workbench. Their findings included structured project folders, status notes, comprehensive target lists, and explicit instructions guiding the coding agent to continuously test, adapt its approach after failures, and manage multiple tasks concurrently.

The recovered files strongly suggest an automated, iterative exploitation process rather than a one-off attack. The attacker’s toolkit first verified a server’s vulnerability, then manipulated PaperCut lookup settings to prepare the environment for code execution.

Hunt.io discovered multiple exploit variants, each tailored for different PaperCut versions and network configurations. Additionally, notes detailing an alternative XML-RPC route were found, intended for scenarios where the API was accessible but protected by weak access controls.

This secondary attack vector is particularly significant as patching the initial vulnerability alone may not secure an API that remains exposed with insufficient authentication or network restrictions.

Post-initial access, the operation expanded beyond the print server. The exposed files revealed tools designed for collecting Windows registry data and service credentials, alongside scripts for establishing reverse SOCKS tunnels.

These tunnels enable attackers to route traffic through a compromised host, effectively gaining access to other systems within the victim’s internal network. The files also documented efforts to automate subsequent activities and package information about compromised systems for persistent access.

A related Cyber Security News report further elaborates on how a foothold within a PaperCut server can serve as a pathway to a domain controller and sensitive account data.

Hunt.io’s recovered intelligence detailed a reconnaissance pool of 1,005 hosts across at least 45 countries. This list included systems confirmed as vulnerable and others flagged as likely vulnerable based on version checks.

This figure differs from GreyNoise’s report of 440 compromised instances, highlighting the varying datasets and metrics used. Hunt.io also identified 45 targets with active reverse SOCKS access at the time of their capture and 46 Active Directory domains within the recovered victim packages.

What You Should Do

• Patch Immediately: Upgrade all PaperCut NG/MF installations to the latest security maintenance releases (versions 26.0.5, 25.0.13, and 24.1.10). Consult PaperCut’s official advisory for detailed upgrade instructions.
• Limit Exposure: Restrict public access to PaperCut management interfaces. If public access is essential, enforce stringent authentication and network allowlists.
• Secure APIs: Limit or secure the XML-RPC API with strong authentication and network restrictions.
• Review Logs and Alerts: Actively monitor security logs and endpoint detection and response (EDR) alerts for any suspicious activity related to PaperCut servers.
• Hunt for Compromise: Check for unexpected modifications to user-lookup.* settings, unauthorized files within PaperCut’s custom/web/ directory, unusual child processes spawned by PaperCut, and signs of chisel-based tunnels or cron persistence mechanisms (as recommended by Hunt.io).
• Post-Patch Investigation: Recognize that patching prevents future exploitation but does not remediate existing compromises. Conduct a thorough forensic investigation for unexpected user accounts, privilege escalations, credential harvesting attempts, unusual outbound network connections, and any signs of unauthorized access to Active Directory.

These records illustrate how attackers can transform initial access into a persistent network foothold, while also emphasizing that each count originates from distinct datasets and measurement methodologies.

For defenders, the critical response involves immediate patching and a comprehensive investigation. PaperCut advises upgrading to its latest security maintenance releases and following its advisory for the correct patching procedure.

Organizations should also restrict public exposure of PaperCut management interfaces, limit the XML-RPC API or implement robust authentication and network allowlists, and meticulously review logs and endpoint alerts for any indicators of suspicious activity.

Hunt.io further recommends examining for unexpected changes to user-lookup.* settings, files written under PaperCut’s custom/web/ directory, unusual child processes, and evidence of chisel-based tunnels or cron persistence mechanisms.

The urgency extends beyond merely confirming a server is patched. A patch addresses known vulnerabilities, but it cannot ascertain whether an intruder has already gained access. Administrators must actively search for unexpected accounts, privilege modifications, credential collection activities, unusual outbound connections, and any indications of unauthorized access to Active Directory.

Further context for reviewing post-exploitation activity can be found in the PaperCut command-execution coverage and a separate report detailing a PaperCut server exploited to gain access to a domain controller.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.