Loading story…
Attackers exploited the actively exploited PaperCut MF zero days CVE-2026-81578 and CVE-2026-82078 on an internet-facing PaperCut MF 24.0.2 Build 69746 server at an education-sector organization. Malicious Java code delivered through the card or ID lookup function installed an in-memory loader and memory-resident web shell, which accepted commands through the X-Quad HTTP header and removed forensic artifacts. The attackers then deployed an AdaptixC2 implant concealed in a trojanized Microsoft Copilot executable.
Using a duplicated token for a domain-privileged service account, the operators pivoted to the domain controller, hijacked the PlugPlay service for execution, dumped credentials, enabled Restricted Admin mode, and used pass-the-hash RDP. They created and archived an NTDS.dit backup with the SYSTEM hive, obtaining material capable of compromising all Active Directory accounts in the domain. eSentire isolated the affected host and urged organizations to patch PaperCut MF/NG immediately, limit PaperCut application-server access to trusted IPs, apply least privilege to service accounts, and investigate suspicious pc-app.exe child processes, PaperCut log manipulation, and service-configuration changes.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
eSentire published its advisory covering the exploited PaperCut MF vulnerabilities CVE-2026-82078 and CVE-2026-81578.
eSentire's Threat Response Unit detected the intrusion at an education-sector customer and isolated the affected host, assisting the organization with remediation.
Attackers exploited CVE-2026-81578 and CVE-2026-82078 on an internet-facing PaperCut MF 24.0.2 Build 69746 server, delivering Java loaders and an in-memory web shell. They installed a trojanized Microsoft Copilot executable carrying AdaptixC2, escalated using a domain-privileged service account, moved to a domain controller, and created an archive containing NTDS.dit and the SYSTEM hive for exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceesentire.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PaperCut has confirmed active exploitation of an undisclosed zero-day affecting **all versions** of its PaperCut NG and MF print-management products. The attacks target publicly accessible PaperCut Application Servers, and the vendor has reported customer incidents but has not disclosed the flaw’s technical details, attacker attribution, post-compromise actions, or whether data was stolen. PaperCut released emergency patches for public-facing Application Servers and urged customers to immediately restrict the web interface to trusted IP addresses using firewall or network controls. Administrators should investigate alerts involving suspicious `pc-app.exe` activity, altered or missing `server.log` files, and anomalous log errors; however, PaperCut cautioned that the absence of these indicators does not confirm a system is uncompromised. The incident follows prior ransomware and state-linked exploitation of PaperCut flaws, including `CVE-2023-27350` and `CVE-2023-27351`.
Sep 3, 2026
Attackers are exploiting two vulnerabilities in **PaperCut NG** and **PaperCut MF**—`CVE-2026-81578`, an authentication-bypass flaw, and `CVE-2026-82078`, an unsafe dynamic class-loading issue. Chained together, the flaws can permit unauthenticated configuration changes and remote code execution as `SYSTEM` on PaperCut Application Servers, creating opportunities for credential theft, persistence, and potential Active Directory compromise. Campaigns have reportedly targeted educational organizations in the United States and Europe, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog. PaperCut issued emergency releases for supported branches, including versions **24.1.10**, **25.0.13**, and **26.0.5**, followed by tested maintenance releases. The third emergency patch added protections and addressed SAML authentication and legacy Microsoft SQL Server driver issues after Rapid7 identified that the initial patch could be bypassed. Organizations should deploy the current maintenance versions, validate patched integrations, review logs and indicators of compromise for pre-patch activity, and rebuild affected application servers where compromise is suspected; 23.x and earlier versions reportedly lacked a patch at the time of reporting.
Sep 16, 2026
Security agencies warned that multiple vulnerabilities in **PaperCut MF** and **PaperCut NG** can expose organizations to serious compromise, including the actively exploited flaw **`CVE-2023-27350`**. CISA previously reported that malicious actors were exploiting the vulnerability in the wild, allowing unauthenticated attackers to gain remote access to vulnerable PaperCut application servers and potentially execute code, making internet-exposed print management systems a high-risk target. A later security bulletin from HKCERT highlighted additional PaperCut vulnerabilities, reinforcing ongoing risk around the platform and the need for prompt remediation. Together, the advisories indicate that unpatched PaperCut deployments remain attractive entry points for attackers, with affected organizations urged to review vendor guidance, apply available updates, and assess exposed servers for signs of compromise.
Jun 29, 2026