PaperCut Flaws Exploited in AI-Powered Attacks
Two zero-day vulnerabilities in PaperCut NG/MF were exploited in AI-powered attacks by a Russian-speaking threat actor targeting hundreds of organizations worldwide. The flaws allowed remote unauthenticated attackers to bypass authentication and execute arbitrary code. The attacker used AI to rapidly build, test, and deploy exploits, compromising 440 deployments across 48 countries, primarily in the education sector. Credential harvesting, secret exfiltration, and domain admin privilege escalation were observed. The vulnerabilities were disclosed and patched shortly after, but the campaign demonstrated rapid exploitation using AI automation.
AI Analysis
Technical Summary
Two zero-day vulnerabilities in PaperCut NG/MF, tracked as CVE-2026-82078 and CVE-2026-81578, were disclosed on August 27, 2026, and patched the next day. These flaws allow remote unauthenticated attackers to bypass authentication and execute arbitrary code on vulnerable instances. A Russian-speaking threat actor used AI to automate exploit development and deployment against 440 PaperCut NG/MF deployments in 48 countries, targeting 395 organizations. The attacker performed credential harvesting on 280 hosts, exfiltrated secrets from 137, and gained domain admin privileges on 12 hosts. The campaign primarily affected the education sector but also impacted multiple other industries. Attack paths included harvesting LSASS memory, mounting NoPac attacks on unpatched instances, and adding accounts to Domain Admins on Domain Controllers. The use of AI enabled rapid compromise within minutes or seconds.
Potential Impact
The vulnerabilities allowed remote unauthenticated attackers to bypass authentication and execute arbitrary code on PaperCut NG/MF instances. The attacker harvested credentials from 280 hosts, exfiltrated secrets from 137, and achieved domain admin privileges on 12 hosts. This level of access could enable further lateral movement, data theft, or deployment of ransomware. The campaign affected hundreds of organizations worldwide, with significant impact on the education sector and other industries.
Mitigation Recommendations
The vulnerabilities CVE-2026-82078 and CVE-2026-81578 were disclosed on August 27, 2026, and patched the next day. Organizations should apply the official patches immediately to mitigate these flaws. Since this is not a cloud service, remediation depends on patching vulnerable PaperCut NG/MF instances. Patch status is confirmed as fixed by the vendor. No additional mitigation actions are specified beyond applying the official fixes.
PaperCut Flaws Exploited in AI-Powered Attacks
Description
Two zero-day vulnerabilities in PaperCut NG/MF were exploited in AI-powered attacks by a Russian-speaking threat actor targeting hundreds of organizations worldwide. The flaws allowed remote unauthenticated attackers to bypass authentication and execute arbitrary code. The attacker used AI to rapidly build, test, and deploy exploits, compromising 440 deployments across 48 countries, primarily in the education sector. Credential harvesting, secret exfiltration, and domain admin privilege escalation were observed. The vulnerabilities were disclosed and patched shortly after, but the campaign demonstrated rapid exploitation using AI automation.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Two zero-day vulnerabilities in PaperCut NG/MF, tracked as CVE-2026-82078 and CVE-2026-81578, were disclosed on August 27, 2026, and patched the next day. These flaws allow remote unauthenticated attackers to bypass authentication and execute arbitrary code on vulnerable instances. A Russian-speaking threat actor used AI to automate exploit development and deployment against 440 PaperCut NG/MF deployments in 48 countries, targeting 395 organizations. The attacker performed credential harvesting on 280 hosts, exfiltrated secrets from 137, and gained domain admin privileges on 12 hosts. The campaign primarily affected the education sector but also impacted multiple other industries. Attack paths included harvesting LSASS memory, mounting NoPac attacks on unpatched instances, and adding accounts to Domain Admins on Domain Controllers. The use of AI enabled rapid compromise within minutes or seconds.
Potential Impact
The vulnerabilities allowed remote unauthenticated attackers to bypass authentication and execute arbitrary code on PaperCut NG/MF instances. The attacker harvested credentials from 280 hosts, exfiltrated secrets from 137, and achieved domain admin privileges on 12 hosts. This level of access could enable further lateral movement, data theft, or deployment of ransomware. The campaign affected hundreds of organizations worldwide, with significant impact on the education sector and other industries.
Mitigation Recommendations
The vulnerabilities CVE-2026-82078 and CVE-2026-81578 were disclosed on August 27, 2026, and patched the next day. Organizations should apply the official patches immediately to mitigate these flaws. Since this is not a cloud service, remediation depends on patching vulnerable PaperCut NG/MF instances. Patch status is confirmed as fixed by the vendor. No additional mitigation actions are specified beyond applying the official fixes.
Technical Details
- Classification
- {"confidence":0.72,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.securityweek.com/papercut-flaws-exploited-in-ai-powered-attacks/","fetched":true,"fetchedAt":"2026-09-11T08:31:57.282Z","wordCount":1049}
Threat ID: 6aa3bc7d91cc7f3848e5ac6c
Added to database: 09/11/2026, 08:31:57 UTC
Last enriched: 09/11/2026, 08:32:09 UTC
Last updated: 09/11/2026, 21:17:01 UTC
Views: 29
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.