Two critical zero-day vulnerabilities in the print management systems PaperCut NG and PaperCut MF — CVE-2026-81578 (authentication bypass, CVSS 8.8) and CVE-2026-82078 (remote code execution, CVSS 9.4) — are being actively exploited in a large-scale campaign. According to Blackpoint Cyber and GreyNoise, a suspected Russian-speaking attacker employed hundreds of AI agents to automate the entire attack cycle — from exploit development to compromise — impacting at least 440 PaperCut instances in 395 organizations across 48 countries. Both vulnerabilities were added to the CISA KEV catalog on August 31, 2026, with a remediation deadline of September 14. We have previously covered these vulnerabilities in the context of credential theft; the threat landscape has now expanded significantly.
Technical nature of the vulnerabilities
The attack chain combines two flaws which individually pose a serious but limited threat, yet together provide pre-authentication remote code execution.
CVE-2026-81578 is an access control flaw in the PaperCut web interface. According to Huntress, under certain conditions an unauthenticated request can lead to administrative actions being executed on the server before permission checks are completed. This allows an attacker to modify the system configuration without any authorization.
CVE-2026-82078 is an unsafe dynamic class loading issue in the database connection mechanism. PaperCut loads driver classes whose names are specified in the configuration, but does not validate them against an allowed list. If an attacker has already gained the ability to change the configuration (via the first vulnerability), they can execute arbitrary Java bytecode with the privileges of the PaperCut process.
Huntress confirmed they were able to reproduce the full chain: pre-authentication code execution resulted in the launch of the charmap.exe process with SYSTEM privileges in the context of the pc-app.exe process — the PaperCut Application Server process.
Scale of the campaign and the role of AI
According to reports from Blackpoint Cyber and GreyNoise, the activity originates from IP address 45.142.193[.]132, which GreyNoise has been tracking since early July 2026 in connection with scanning of Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE systems.
The key feature of the campaign is the use of hundreds of AI agents based on OpenAI Codex and the DeepSeek model, combined with well-known offensive tools: Mimikatz, SharpHound, Certipy, Rubeus and Impacket. According to GreyNoise, the attacker went from an empty workspace to the first remote code execution on a real victim in less than four hours. After the mass phase of the campaign started, 11 organizations were compromised within 26 seconds. In one case — an attack on a school in the US — only seven minutes elapsed between initial access and obtaining domain administrator privileges.
According to Blackpoint Cyber, AI was used not only to generate exploits, but also to build the entire operational pipeline: vulnerability research, comparison of patched and unpatched builds, creation of a multithreaded validation tool, filtering targets by geolocation and country, error analysis and retries. The system maintained project context throughout the entire lifecycle — from research to exploitation. Two open-source tools were used for this: Hindsight (a persistent memory service for AI agents) and AionUi (a graphical environment for parallel agent execution).
According to GreyNoise, the attacker explicitly tried to exclude organizations in 28 countries, including Russia, China, Hong Kong, Iran and several others, from the attack, although this filtering did not work in all cases. The main impact fell on the education sector in the US, the UK, France, Spain, Canada and several European countries.
Observed post-exploitation activity
Huntress observed exploitation in two customer environments. In both cases, the activity was limited to reconnaissance: the commands whoami, ver and tasklist were executed to determine the account, OS version and running processes. No secondary malware, additional command-and-control channels, or persistence mechanisms were detected in these environments.
In the broader campaign described by GreyNoise, post-exploitation activity included collection of Windows registry data, Java Metasploit/Meterpreter payloads, and commands to enumerate hosts, users and configuration data. Domain administrator access was obtained in only 12 out of 395 organizations. The attacker’s ultimate goals remain unclear — GreyNoise notes it is unknown whether the threat actor is acting as an initial access broker or plans to independently conduct data theft or deploy ransomware.
Indicators of compromise and detection
According to Huntress, the following combination of signs should be used to identify compromise:
- Suspicious activity by the
pc-app.exeprocess or child processes spawned by it - Missing or truncated
server.logfile (the payload deleted it after execution) - Unexpected
.classfiles in theserver/libdirectory .cmdor.outfiles in theserver/data/contentdirectory- “No suitable driver found for jdbc:no:x” and “Database error looking up cardID: VALUES CAST” errors in the logs
It is the combination of these artifacts — rather than each individually — that is a reliable indicator. The presence of activity from the pc-app.exe process together with a missing server.log and atypical class files narrows the search much more precisely than simply checking whether PaperCut is reachable from the internet.
IOC: IP address 45.142.193[.]132 (VirusTotal).
Remediation recommendations
PaperCut has released full security updates that replace all previously published emergency patches (the first of which turned out to be incomplete and allowed bypass):
- PaperCut NG/MF 26.0.5
- PaperCut NG/MF 25.0.13
- PaperCut NG/MF 24.1.10
These releases include all fixes from emergency patches 1, 2 and 3, as well as additional security hardening measures. Organizations that installed the emergency patches should move to the corresponding maintenance release. According to Huntress, at the time of the initial report on August 27, 47% of the PaperCut installations they were tracking were running version 23 or older, for which no patch was available. Users of these versions are advised to upgrade to a current release.
In addition to updating, PaperCut strongly recommends removing the Application Server web interface from public access and allowing connections only from trusted IP addresses, via VPN or another controlled channel. Site Server and additional print servers should also be updated. The Print Deploy and Mobility Print components are not affected by the vulnerabilities.
This campaign demonstrates a qualitative shift in how attackers use AI: here, artificial intelligence is not just helping to write an exploit, but is the central element of the entire operational architecture — from vulnerability research to scaling the attack with feedback. Organizations using PaperCut NG/MF must immediately install updates to versions 26.0.5, 25.0.13 or 24.1.10, remove the web interface from public access and check their systems for the described indicators of compromise — the CISA KEV remediation deadline expires on September 14, 2026.
