Critical PaperCut Flaws Let Attackers Execute Code, Exploit Underway

Key Takeaways

• Two critical vulnerabilities, CVE-2026-81578 and CVE-2026-82078, in PaperCut servers are under active exploitation.
• Attackers are using these flaws to execute arbitrary code, steal credentials, and create new privileged accounts.
• The vulnerabilities impact PaperCut print management servers, often found in enterprise environments.
• PaperCut has confirmed the active exploitation, and organizations are urged to apply patches immediately.

Hackers Exploit Critical PaperCut Flaws for Code Execution and Credential Theft

Cybersecurity researchers have issued urgent warnings regarding two critical vulnerabilities, identified as CVE-2026-81578 and CVE-2026-82078, affecting PaperCut servers. These flaws are actively being exploited in the wild, enabling threat actors to execute arbitrary commands, exfiltrate sensitive credentials, and potentially establish persistent access through the creation of highly privileged user accounts within victim networks.

According to recent analysis from Arctic Wolf Threat Intelligence, these vulnerabilities are being leveraged to compromise networks via vulnerable PaperCut print-management servers. This initial compromise then serves as a springboard for further post-exploitation activities, allowing attackers to deepen their foothold and expand their malicious operations.

The severity of this threat is underscored by PaperCut’s confirmation that active exploitation commenced on August 27, 2026. The CVE identifiers were assigned just one day later, and by August 31, the vulnerabilities were added to CISA’s Known Exploited Vulnerabilities catalog, highlighting the rapid escalation and widespread concern among cybersecurity authorities.

The implications of these vulnerabilities are particularly significant because PaperCut servers are commonly integrated into enterprise infrastructures. Their position often grants them access to critical network services, including Active Directory, and sensitive authentication settings, making them high-value targets for adversaries.

Attackers Leverage PaperCut for Reconnaissance and Data Exfiltration

Following a successful compromise of affected PaperCut servers, attackers typically initiate reconnaissance activities to gather intelligence about the operational environment. Standard discovery commands, such as whoami, ver, tasklist, and uname -a, are executed to identify the compromised host, enumerate logged-in users, list running processes, and ascertain operating system details.

According to Arctic Wolf Threat Intelligence’s report on GitHub, unusual behavior has been observed where the PaperCut process pc-app.exe is seen launching cmd.exe and PowerShell, which are anomalous actions for typical print-management software.

Attackers have also been observed employing specific commands to search for sensitive information within PaperCut configuration files. The command findstr /s /i /n /c: "password"/c: "secret"/c: "bind"/c: "ldap"/c: "token" indicates a clear intent to extract critical authentication data, including LDAP bind credentials, API tokens, and service passwords, which are often stored in these files.

Credential theft forms a core component of this campaign. Threat actors are deploying tools such as lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe. These tools are delivered using certutil, a legitimate Windows utility frequently abused by attackers to retrieve remote files. Their purpose is to extract registry data crucial for decrypting protected registry secrets and targeting the Security Account Manager (SAM) database, thereby harvesting user credentials.

Researchers have also noted incoming requests for files matching specific patterns, suggesting attempts to retrieve command output or other collected data from compromised systems. Furthermore, the presence of Meterpreter Java payloads points to the potential use of Metasploit tools for establishing persistent remote access and facilitating ongoing exploitation.

Of particular concern are reports indicating attempts to create a privileged account named “Administrator17” within compromised environments. This tactic poses a significant risk, as it can grant attackers sustained access, even if the initial vulnerabilities are patched. Organizations are strongly advised to scrutinize account management logs for any unexpected administrator accounts created around the time of suspicious PaperCut server activity.

Given that PaperCut has been a recurring target for cyberattacks, with previous vulnerabilities like CVE-2023-27350 and CVE-2023-27351 being linked to LockBit ransomware operations, the urgency for swift action, including patching and proactive threat hunting, is paramount.

For effective detection and response, defenders should meticulously review PaperCut server log files for any entries related to exploitation, particularly specific error messages. Additionally, monitoring for the creation of short, five-character files or unusual activations of command interpreters associated with pc-app.exe is highly recommended.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Immediately apply all available patches and updates released by PaperCut to address CVE-2026-81578 and CVE-2026-82078.
• Block all identified malicious IP addresses at your network perimeter.
• Isolate any potentially compromised PaperCut servers from the network to prevent further lateral movement.
• Rotate all credentials that may have been exposed or accessed from compromised PaperCut servers.
• Thoroughly investigate administrator account management logs for the unexpected creation of new privileged accounts, especially “Administrator17.”
• Implement continuous monitoring of PaperCut server logs for the Indicators of Compromise (IOCs) provided, including specific error messages, unusual command executions, and suspicious file patterns.
• Conduct proactive threat hunting across your environment to detect any lingering presence of attackers or additional compromised systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.