CRITICAL: PaperCut Zero-Days Exploited to Breach 395 Organizations

Print management is the software equivalent of building plumbing. Nobody thinks about it, nobody wants to pay for it, and everybody notices the moment it backs up. It also happens to run on a Windows server holding domain credentials, a database connection, and a web console that somebody published to the internet years ago so the satellite campus could check print quotas. Attackers noticed. Roughly four hundred organizations across forty eight countries have now found out what that costs.

On September 10, PaperCut shipped maintenance releases 26.0.5, 25.0.13, and 24.1.10 across the NG and MF product lines. These are not routine builds. They roll up every fix from Emergency Patch Releases 1, 2, and 3, the ones that went out in a hurry through the last week of August, and they layer additional hardening on top. If you are sitting on one of those emergency builds and quietly promised yourself you would circle back once things calmed down, things are not going to calm down. Circle back today.

Two bugs that are far worse together

The story starts with CVE-2026-81578, an improper access control flaw in the PaperCut web management interface. NVD scores it 9.8 under CVSS v3.1 while PaperCut rates it 8.8 under the newer CVSS v4.0 framework, and the gap between those two numbers is a rounding error next to what the bug actually does. A crafted request convinces the application to render one page while executing actions belonging to a completely different one. The authorization check looks at the page being rendered, decides everything is fine, and never validates permissions on the component that actually ran. The result is that an unauthenticated attacker on the far side of an HTTP request can change system configuration.

On its own that is bad. Paired with CVE-2026-82078 it becomes a full compromise. That second flaw lives in PaperCut's database connection utilities, where the application instantiates JDBC driver classes from a configurable driver name without ever checking that name against an allowlist. NVD puts it at 9.1 under CVSS v3.1 and PaperCut calls it 9.4 critical under v4.0. The official scoring assumes the attacker already holds high privileges, which is the only reason the number is not worse. CVE-2026-81578 hands over exactly those privileges for free.

Chain the two and you get arbitrary Java bytecode executing inside the PaperCut Application Server process. On a typical Windows deployment that process runs with substantial local rights, and the server it runs on almost always talks to Active Directory, because that is how print release and user lookups function in the first place. Preauthentication remote code execution on a box your directory already trusts is about as good as an initial foothold gets.

What exploitation looked like in the wild

Huntress observed the first real attack activity on August 26, a day before PaperCut published its advisory. Emergency patches followed on August 27 and 28, and CISA added both CVEs to the Known Exploited Vulnerabilities catalog on August 31. The early Huntress incidents were almost polite, base64 encoded commands that decoded to whoami and ver, then a slightly greedier round that tacked on tasklist. Reconnaissance and nothing more.

That restraint did not last. Blackpoint Cyber and GreyNoise Intelligence have since documented a campaign that compromised more than 440 PaperCut instances belonging to at least 395 identified organizations across 48 countries, with education absorbing the worst of it. Schools and universities in the United States, United Kingdom, France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland all appear in the victim data. Twelve of those organizations were taken all the way to domain administrator. Eleven were compromised within twenty six seconds of the campaign kicking off. One American high school went from initial access to domain admin in seven minutes, which is less time than it takes most of us to get through a password reset ticket.

The operator, assessed as a Russian speaking actor working from 45.142.193[.]132, built an exclusion list of twenty eight countries including Russia, China, Hong Kong, Iran, Venezuela, Indonesia, and Pakistan. GreyNoise notes that "the adversary did explicitly attempt to avoid targeting entities in 28 identified countries," and also that the observed victimology shows the restraint failed in some instances. Geofencing written by a machine at three in the morning turns out to be roughly as reliable as geofencing written by a human at three in the morning.

The part drawing the most attention is how the campaign was assembled. Blackpoint's analysis describes an operation scaffolded on hundreds of AI agents driven by OpenAI's Codex and a DeepSeek model, stitched together with a persistent memory service called Hindsight and a unified graphical workspace called AionUi. Target selection ran through the Netlas.io internet scanning service by way of an exposed API key. Vulnerability research detected as early as August 31 was converted, in Blackpoint's telling, into "a multi-threaded validation tool that was reviewed, tested, and run against progressively larger target sets" within hours.

None of the post exploitation tooling is exotic. Mimikatz, SharpHound, Certipy, Rubeus, and Impacket, plus a Meterpreter Java payload, Windows registry hive collection, and Active Directory enumeration. That is a standard kit that any competent operator already owns. Blackpoint's own framing is the useful takeaway here, that "the strongest AI impact in this campaign was not a novel exploit technique. It was the reduction of human effort required to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems." The tradecraft did not get smarter. It got cheaper, it scaled sideways, and it stopped needing sleep.

What the actor plans to do with all that access remains unclear. Nevan Beal of Blackpoint Cyber put it plainly, saying "at this time, we cannot confirm the exact end goal of this campaign. The threat actor's methodology is consistent with initial-access activity." GreyNoise raised the same question, uncertain whether the access gets handed to affiliates or turned directly into data theft and ransomware. Neither answer is one you want to sit and wait for.

The patch gap nobody wants to discuss

Here is the genuinely ugly part. Huntress tracks roughly 2,500 PaperCut installations and reports that 47 percent of them are running version 23 or older. There is no patch for those. Not a patch that is coming, not a patch to check back on next week. The fix does not exist for that branch at all, which means close to half the deployed base in that sample is staring down a version upgrade project rather than a patch window, in the middle of an active campaign that measures time to domain admin in minutes rather than days.

What to actually do

Get to 26.0.5, 25.0.13, or 24.1.10 depending on your branch, and get there this week. PaperCut had to update its advisory specifically to clarify that site servers and secondary print servers need patching alongside the primary Application Server, so if you patched the main box and called the ticket closed, you are not finished. If you are on version 23 or earlier, the upgrade is the remediation, and until that lands the Application Server has no business being reachable from the internet. Put it behind a VPN or restrict it to trusted networks. This is a print server. It does not need a public IP address.

Before you patch, preserve evidence, because patching cheerfully destroys the artifacts you would want later. Pull the full server/logs directory with file metadata intact, grab the current and non default configuration files, and capture endpoint process trees where pc-app.exe is the parent.

Then go hunting. The cleanest indicator is unexpected .class files sitting in server/lib, typically carrying five character random names. Udydn.class and Moo97.class both turned up in real incidents, each with a matching .out or .cmd file over in server/data/content. Check derby.log for boot messages referencing odd database names, the observed pattern being a DB URL of jdbc:derby:memory:pwn, along with errors reading "No suitable driver found for jdbc:no:x" and cardID lookup failures containing a VALUES CAST. Watch for pc-app.exe spawning command shells or system discovery utilities, base64 blobs showing up in application logs, and any change to external user lookup configuration. A missing, unexpectedly truncated, or deleted server.log is itself a finding, not an inconvenience.

If your PaperCut server was internet facing and unpatched at any point after August 26, assume compromise rather than hoping your way out of it. Rotate service account credentials, review Active Directory for new or modified accounts, and look specifically for the Kerberos and certificate template abuse that Rubeus and Certipy exist to perform. Twelve organizations in this campaign reached domain admin. The path from print server to domain controller is proven, documented, and apparently very fast.

The MSP angle

Every client running an unpatched version 23 PaperCut box is a funded upgrade project sitting in plain sight, and this campaign hands you the business case in one sentence about a high school that lost its entire domain in seven minutes. Bundle that migration with an external attack surface assessment, because an organization that published a print console to the internet has almost certainly published something else too, and that discovery engagement is the easiest recurring revenue you will book this quarter.