PaperCut MF/NG auth bypass and RCE vulnerabilities under attack

Two recently disclosed vulnerabilities in PaperCut MF/NG — CVE-2026-81578 (authentication bypass, CVSS v4.0: 8.8) and CVE-2026-82078 (remote code execution, CVSS v4.0: 9.4) — are being actively exploited by attackers. According to the Arctic Wolf research team, threat actors are using this vulnerability chain to execute commands on compromised servers, perform infrastructure reconnaissance and deploy credential harvesting tools. Organizations running PaperCut MF/NG versions earlier than 24.1.10, 25.0.13 and 26.0.5 must immediately update their servers and restrict their exposure to the internet.

Technical details of the vulnerabilities

According to an entry in the GitHub Advisory Database, CVE-2026-81578 is an improper access control vulnerability in the PaperCut MF/NG web administration interface. Under certain conditions, unauthenticated remote requests can trigger server-side actions before authorization checks are completed, allowing changes to the system configuration. The vulnerability is rated as High with a CVSS v4.0 score of 8.8.

CVE-2026-82078, according to the NVD entry, is related to unsafe dynamic class loading in the PaperCut MF/NG database connection utilities. By manipulating configuration parameters, an attacker can execute arbitrary Java bytecode in the context of the PaperCut server process. The vulnerability is rated as Critical with a CVSS v4.0 score of 9.4. It affects PaperCut MF/NG versions earlier than 24.1.10, 25.0.13 and 26.0.5 — these version numbers are the fixed-version thresholds for the corresponding product branches.

It is important to note that describing the full chain as “authentication bypass → remote code execution” is an analytical interpretation. The CVE entries describe each vulnerability as an independent component rather than a single exploitation chain.

Observed post-exploitation activity

According to Arctic Wolf research published on 4 September 2026, PaperCut disclosed active exploitation on 27 August 2026, and the CVE identifiers were assigned on 28 August 2026. The researchers observed the following post-exploitation activity:

• Execution of reconnaissance commands: uname, whoami, ver, tasklist
• Creation of a privileged account named Administrator17
• Incoming GET requests to paths /custom/pcp_*.txt and /custom/web/pcp_*.txt on compromised hosts — files that presumably contain collected system data and user information
• Downloading credential harvesting tools via certutil.exe: lsa_collect.exe, lsa_collect_small.exe, save_hives.exe
• Retrieval of Java Meterpreter payloads and establishment of sessions with attacker-controlled infrastructure
• Searching PaperCut configuration files (*.config) for the strings password, secret, ldap, bind, token using findstr

Arctic Wolf researchers found that lsa_collect.exe, when analyzed in a sandbox, extracted specific Windows registry keys to recover the system BootKey, which could potentially give an attacker access to the SAM database. It should be emphasized: deployment of credential harvesting tools and targeting of SAM has been observed, but there is no publicly available confirmation of successful credential extraction or subsequent use of stolen credentials.

Indicators of compromise

Based on Arctic Wolf data, the following indicators have been identified:

IP addresses:

• 45[.]142[.]193[.]132 — source of tool downloads and inbound requests
• 45[.]142[.]193[.]196
• 194[.]180[.]48[.]134 — Meterpreter payload delivery server

URLs:

• http[:]//45[.]142[.]193[.]132:8000/lsa_collect.exe
• http[:]//45[.]142[.]193[.]132:8000/lsa_collect_small.exe
• http[:]//45[.]142[.]193[.]132:8000/save_hives.exe
• http[:]//194[.]180[.]48[.]134/kjmdcyzq/com/metasploit/meterpreter/JarFileClassLoader.class

SHA-256 hashes:

• c3f7109963b9599eb93fd9a97a4ffa38e672642b35b33608d69e6bbf9f19da4e
• 14779d0d7ad6be3d7bf9ed78e4ab6016f22dfa7bc8b5d9c43b56011f7fe2ea19

User-Agent:python-requests/2.32.5

Threat context

The specific threat group behind the attacks has not been identified — Arctic Wolf is acting as an observer, not an attribution source. The use of Metasploit/Meterpreter, certutil.exe for file downloads and tools for extracting registry hives points to a standard toolkit typical of a wide range of threat actors, from ransomware operators to initial access brokers.

The source material indicates that the attacks are targeting the education sector in the US and Europe; however, this information has not been corroborated by independent primary sources and is based solely on Arctic Wolf’s statements.

Impact assessment

PaperCut MF/NG servers are widely used for print management in organizations of various sizes. Successful exploitation of the vulnerability chain allows an attacker to obtain code execution on the server, collect credentials from the SAM database and configuration files (including LDAP bind passwords), and then use them to move laterally across the environment. The creation of privileged accounts provides persistent access even after the initial compromise is detected.

The criticality of CVE-2026-82078 (9.4), combined with the authentication bypass via CVE-2026-81578 (8.8), creates conditions for attacks that require no prior credentials against servers exposed to the internet.

Mitigation recommendations

Immediate actions:

1. Update PaperCut MF/NG to versions 24.1.10, 25.0.13 or 26.0.5 and later (depending on the product branch in use)
2. Remove PaperCut servers from direct internet exposure — place them behind a VPN or restrict access by IP
3. Check for the presence of the Administrator17 account and other recently created privileged accounts

Compromise detection:

• Monitor for processes such as cmd.exe, powershell.exe and other command interpreters spawned with pc-app.exe as the parent process
• Search for execution of commands whoami, tasklist, ver, uname -a with pc-app.exe as the parent process
• Review network connections to the IP addresses listed above
• Search for files lsa_collect.exe, lsa_collect_small.exe, save_hives.exe and for accesses to paths /custom/pcp_*.txt
• Verify SHA-256 hashes of discovered files against the indicators provided

Given the confirmed active exploitation and the critical severity of CVE-2026-82078, updating PaperCut MF/NG servers and isolating them from the internet must be treated as a high priority. Organizations that detect the listed indicators should treat the incident as a potential credential compromise and initiate forced password resets for all accounts, including LDAP service accounts whose configuration may have been extracted from PaperCut configuration files.