PaperCut flaws abused in school credential theft

What Happened

Threat actors are exploiting two recently disclosed vulnerabilities in PaperCut print management software to steal credentials from educational institutions across the United States and Europe. The Arctic Wolf Adversary Research Team identified the campaign, which specifically targets schools and universities running vulnerable PaperCut MF and NG versions.

The attacks chain CVE-2026-81578, an unauthenticated configuration change flaw, with CVE-2026-82078, a remote code execution vulnerability. Both CVEs carry critical severity ratings and were disclosed within the same disclosure window, making them attractive for rapid weaponization.

Why It Matters

PaperCut MF and NG are among the most widely deployed print management platforms in the education sector. Schools and universities often run these servers on-premises with internet-facing administrative interfaces, a configuration that converts a print utility into a network entry point. When an attacker compromises a print server, they gain a foothold inside the campus network, often with elevated service account privileges that can access directory services, file shares, and user databases.

Credential theft in this context is not a single-event breach. Stolen credentials from one institution can be replayed against cloud services, learning management systems, and VPN gateways, extending the impact well beyond the print server itself. For an education sector already struggling with understaffed security teams, this campaign represents a direct and ongoing threat to student and staff data.

Technical Details

The attack chain leverages the two CVEs in sequence. First, the attacker exploits CVE-2026-81578 to modify server configuration without authentication, likely disabling security controls or altering authentication settings. This sets the stage for the second exploit, CVE-2026-82078, which enables remote code execution on the PaperCut server.

Arctic Wolf reports that once code execution is achieved, the attackers deploy credential harvesting tooling, including memory dumping utilities and keyloggers, targeting the print server’s cached credentials and adjacent authentication traffic. The campaign shows a clear focus on the education vertical, with observed victims concentrated in U.S. and European schools and universities.

Organizations running PaperCut MF or NG versions earlier than the vendor’s patched releases should assume they are at risk. Internet-exposed administrative interfaces significantly increase the likelihood of exploitation.

Immediate Risk

The risk is critical and time-sensitive. Proof-of-concept code for CVE-2026-81578 has been publicly released, and CVE-2026-82078 has already been observed in active exploitation prior to this credential theft campaign. The pairing of these two flaws creates a reliable, low-skill path to remote code execution on unpatched servers.

Educational institutions should treat any PaperCut server as compromised until proven otherwise. Indicators include unexpected configuration changes, new user accounts on the server, outbound connections to unknown IPs, and unusual print job activity. Immediate actions include applying vendor patches, restricting administrative interface access to trusted networks, and reviewing authentication logs for anomalies.

Security Insight

The pairing of an unauthenticated config change with an RCE is a reminder that print servers occupy a strange trust boundary: they are usually managed by IT but sit adjacent to user data and domain credentials. Historically, similar attacks on print services, such as the 2018 Pwn2Own exploits against HP printers, demonstrated that attackers view these appliances as soft targets. The education sector’s reliance on shared printing infrastructure makes it a natural testing ground for credential harvesting.

Defensive teams should segment print servers from domain controllers and enforce the principle of least privilege on service accounts. Beyond patching, consider deploying network-level monitoring for print server traffic, since legitimate print protocols are often excluded from normal security visibility. If you lack visibility into your print infrastructure, assume the attackers have already looked there. View the IOCs shared by Arctic Wolf and compare them against your environment logs.

Further Reading

• PaperCut server RCE exploited in the wild (CVE-2026-82078)
• PaperCut MF/NG exploited, unauth config change (CVE-2026-81578) [PoC]
• Latest Security News
• CVE Advisories
• Data Breach Reports