AI-powered attack exploited PaperCut flaws to hack 395 organizations
Source Bleeping Computer
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 10 Sep 2026, 16:36 UTC
What to do
AI-suggested
PaperCut has released emergency security updates addressing CVE-2026-81578 and CVE-2026-82078. System administrators must apply these patches immediately. Following the vendor's official recommendations in the security bulletin is critical. No indication exists that the vulnerabilities are mitigated without patching. Given the rapid exploitation and post-compromise techniques, organizations should assume compromise if vulnerable and conduct thorough incident response.
Description
A threat actor used AI-powered agents to exploit two vulnerabilities in PaperCut NG/MF servers, compromising at least 440 instances across 395 organizations globally. The campaign rapidly developed and launched exploits for CVE-2026-81578 and CVE-2026-82078, primarily targeting the education sector. Attackers harvested credentials, obtained domain secrets, and achieved administrator privileges in multiple organizations. The campaign employed advanced post-exploitation techniques including pass-the-hash, noPac attacks, and DCSync to extract domain credentials. The attacker toolkit included well-known offensive tools and custom utilities. System administrators are urged to apply PaperCut's emergency security updates immediately. The attack demonstrated unprecedented speed and automation enabled by AI, significantly reducing defenders' response time.