PaperCut Exploitation Escalates to Active Intrusions

Threat actors have rapidly escalated exploitation of two critical PaperCut NG/MF vulnerabilities (CVE-2026-82078 and CVE-2026-81578) from initial reconnaissance to full hands-on-keyboard intrusions, demonstrating how quickly unpatched print management software can become a gateway for deep network compromise. Print management systems are often overlooked in patch cycles despite being networked, internet-accessible, and running with elevated privileges — making them high-value targets. The involvement of initial access brokers suggests these footholds are being packaged and sold, meaning the window between exploitation and serious damage is shrinking. CISA's emergency directive mandating federal patches by September 14 underscores the critical severity of these flaws. Organizations that delay patching internet-facing management software risk handing attackers a persistent, privileged beachhead inside their networks.