PaperCut Exploitation Escalates to Active Intrusions

Summary

Threat actors have escalated attacks exploiting two PaperCut NG/MF vulnerabilities, moving from reconnaissance to hands-on-keyboard intrusions. CISA has added these flaws, CVE-2026-82078 and CVE-2026-81578, to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by September 14. Attackers are using sophisticated techniques for pivoting and maintaining access, indicating potential involvement of initial access brokers or more aggressive operators.

Full text

Attacks exploiting two recently discovered PaperCut NG/MF vulnerabilities have escalated, with threat actors shifting from reconnaissance to hands-on-keyboard activity. PaperCut first warned users of its NG and MF print management solutions about an actively exploited zero-day vulnerability on August 27. It later emerged that threat actors have been chaining two flaws in their attacks. The vulnerabilities are tracked as CVE-2026-82078 and CVE-2026-81578, and they can be exploited by unauthenticated attackers to bypass authentication and achieve remote code execution on affected PaperCut NG/MF instances. The vendor quickly rolled out two emergency patches — one after the first was bypassed — and is working on an official release that addresses both vulnerabilities. In the meantime, attacks are escalating, according to exposure management firm WatchTowr, whose researchers have been monitoring the situation. “Activity has significantly evolved, and it did so quickly — we are no longer seeing purely exploratory probes to identify vulnerable systems, but real-world exploitation accompanied with hands-on-keyboard interaction from human attackers exploring systems they’ve compromised,” Jake Knott, head of threat intelligence at WatchTowr, said via email.Advertisement. Scroll to continue reading. “As part of this activity, it’s noteworthy that this appears to be ‘above average’ (the bar still being very low) in terms of sophistication — some designed purely to facilitate external to internal network pivoting and continue attacks,” Knott added. “Attackers are, as always, being selfish — keying access to their deployed in-memory payloads to ensure that only they are able to access compromised hosts and continue further. This behavior is reflective of initial access brokers, and other more aggressive-outcome type operators.” PaperCut’s updated indicators of compromise (IoCs) also indicate attack escalation, specifically the deployment of remote access tools on targeted systems. Technical details on CVE-2026-82078 and CVE-2026-81578 are also available from security firms Huntress and Rapid7. The cybersecurity agency CISA added CVE-2026-82078 and CVE-2026-81578 to its Known Exploited Vulnerabilities (KEV) catalog on Monday. Federal agencies have been instructed to address the flaws by September 14. More than 1,000 PaperCut NG/MF instances are exposed to the internet, according to data from ShadowServer. “If exposed to the Internet and unpatched at any stage in the last few days, systems should be assumed compromised by an active attacker who is combing through vulnerable hosts looking for interesting or valuable targets,” WatchTowr’s Knott warned. “And if you haven’t already, now is the time to trigger incident response processes. Patching alone will lock out new attackers while allowing existing attackers to maintain access and go further.” Related: Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit Related: ServiceNow Patches 3 Critical Code Injection Vulnerabilities Related: Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs More Details Emerge on Exploited PaperCut VulnerabilitiesHasbro Data Breach Exposed Employee Personal InformationATF Confirms Cyber Incident After Ransomware Group Claims AttackOpenAI Agents Exploited Linux Kernel Flaw on Company’s Own SystemsTech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense PledgePaperCut Releases Emergency Patch for Exploited Zero-DayTrump Order Aims to Block Foreign Backdoors in US Power Grid GearAustralia Arrests 2 Alleged TeamPCP Hackers Latest News Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product ExploitServiceNow Patches 3 Critical Code Injection VulnerabilitiesMcKesson Confirms Data Breach as Attacker Deadline LoomsWhat the Hugging Face Incident Teaches Security Leaders About AI Agent AccessAnthropic Warns Claude Users of Infostealer Malware InfectionsCritical Ruby on Rails Vulnerability in Attackers’ CrosshairsBoston Scientific Still Recovering From CyberattackExtortion Group Claims Manchester Airports Group Data Breach Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover? September 2, 2026 In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk. Register People on the MoveSocial engineering protection company Doppel has promoted Alyssa Smrekar to Chief Marketing Officer.Naveen Bhateja has been appointed Chief People Officer at HackerOne.The Department of War has appointed Sonu Shankar as Principal Deputy Chief Information Officer.More People On The MoveExpert Insights What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Silent Patches Don’t Stop Attackers – They Blind Defenders Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. (Tod Beardsley) Hired for One Job, Judged on Another: The CISO’s Real Problem The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job. (Sravish Sridhar) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-82078
• cve — CVE-2026-81578

Entities