CVE-2026-81578 & CVE-2026-82078: PaperCut Auth Bypass and RCE Chain Exploited Against Education — Detection and Remediation Guide

The Arctic Wolf Adversary Research Team has confirmed in-the-wild exploitation of two newly disclosed PaperCut vulnerabilities — CVE-2026-81578 (an authentication bypass) and CVE-2026-82078 (unauthenticated remote code execution) — chained together in attacks targeting the education sector across the United States and Europe. Observed post-exploitation activity includes command execution, host and network reconnaissance, and credential theft.

If you run PaperCut NG or PaperCut MF — and if you are a school, university, or managed print provider serving one, you almost certainly do — treat this as an active incident scenario, not a patching backlog item. PaperCut servers sit in a uniquely dangerous position: they are typically domain-joined, hold print queues full of sensitive documents, frequently integrate with Active Directory/LDAP for user authentication, and are often exempted from the hardening scrutiny applied to other internet-adjacent services. Attackers know this. Print management software has been a favored initial-access vector for years precisely because it blends into the environment while offering a direct path to credential material and lateral movement.

Education-sector defenders should assume scanning and exploitation attempts are already hitting any PaperCut application server reachable from the internet or from flat internal networks. The sections below give you the attack-chain breakdown, detection logic, and a verification and hardening script you can run today.

Technical Analysis

Affected Products and Components

The vulnerable component is the PaperCut NG/MF Application Server — the central management service that exposes the administrative web interface (commonly on TCP 9191/9192 for HTTP/HTTPS) and handles authentication against directory backends. Both on-premises Windows and Linux deployments are in scope. Organizations running PaperCut behind reverse proxies or exposing it for remote/mobile printing workflows have the largest attack surface, but Arctic Wolf's reporting indicates internal exploitation following other access paths as well.

Check your vendor advisory and About page or the version.properties file on the application server to confirm your build against the fixed release listed in PaperCut's security bulletin for these CVEs.

The Vulnerability Chain

The two CVEs are dangerous individually; chained, they are critical:

1. CVE-2026-81578 — Authentication Bypass. The attacker circumvents the authentication mechanism on the application server, gaining access to functionality that should require valid admin or user credentials. Auth bypass flaws in management interfaces are consistently high-value because they collapse the entire trust boundary of the product without needing a single stolen password.

2. CVE-2026-82078 — Unauthenticated Remote Code Execution. Combined with the bypass, the attacker achieves arbitrary command execution in the context of the PaperCut service account. On Windows deployments this service frequently runs as SYSTEM; on Linux it commonly runs with broad local privileges. Either way, the outcome is effectively full host compromise.

Observed Post-Exploitation Behavior

Per Arctic Wolf's telemetry, the intrusion pattern after successful exploitation follows a predictable and detectable sequence:

• Command execution via the PaperCut server process. On Windows this manifests as pc-app.exe or its Java runtime (java.exe running from the PaperCut installation directory, typically C:\Program Files\PaperCut MF\ or C:\Program Files\PaperCut NG\) spawning child processes such as cmd.exe, powershell.exe, or whoami.exe. On Linux, watch the PaperCut service user spawning shells.
• Reconnaissance — host enumeration (systeminfo, ipconfig /all, netstat), domain discovery (net group "Domain Admins" /domain, nltest /dclist), and directory queries consistent with an operator mapping the environment before lateral movement.
• Credential theft — access to LSASS memory, extraction of cached credentials, and harvesting of the PaperCut server's own directory-service credentials. Because PaperCut commonly binds to LDAP/AD with a service account, that account's credentials are a prime target and frequently have read access across the directory — sometimes more.

Exploitation Status

• Confirmed active exploitation in the wild against education-sector targets in the U.S. and Europe, per Arctic Wolf.
• The auth-bypass-plus-RCE chain requires no valid credentials and no user interaction — network reachability to the application server is the only prerequisite.
• Monitor CISA's Known Exploited Vulnerabilities catalog; given confirmed exploitation, addition of one or both CVEs is a realistic near-term possibility and would impose a federal remediation deadline. Do not wait for KEV listing to act.

This is also not the first time PaperCut has been exploited at scale — the platform has a documented history of being weaponized by both criminal and state-aligned actors, which means exploitation tooling and tradecraft for this target class are mature and will proliferate quickly once details circulate.

Detection & Response

The detections below focus on the highest-fidelity observable from this campaign: the PaperCut application server process spawning command interpreters and enumeration tooling. In a healthy environment, pc-app.exe / its Java runtime rarely spawns interactive shells — that signal alone justifies high severity. Tune allowlists for your legitimate print-script integrations (PaperCut supports custom scripts, so baseline first, then alert on deviation).

Sigma Rules

---
title: PaperCut Application Server Spawning Command Shell or Scripting Engine
id: 3f9c1a74-8b2e-4d61-a9f0-5e7c2b84d1a3
status: experimental
description: Detects the PaperCut NG/MF application server process (pc-app.exe or its bundled Java runtime) spawning cmd.exe, powershell.exe, or other command interpreters — consistent with post-exploitation activity following CVE-2026-81578 / CVE-2026-82078 exploitation.
references:
  - https://thehackernews.com/2026/09/attackers-exploit-papercut-flaws-to.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pc-app.exe'
      - '\java.exe'
      - '\javaw.exe'
  selection_parent_path:
    ParentImage|contains:
      - '\PaperCut MF\'
      - '\PaperCut NG\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_parent_path and selection_child
falsepositives:
  - Legitimate PaperCut print scripting integrations invoking cmd or PowerShell — baseline and tune per environment
level: high
---
title: Reconnaissance Commands Executed Under PaperCut Service Context
id: 8c2e5f19-4a7d-4b93-b6e1-2d9a4c75f8b2
status: experimental
description: Detects host and domain enumeration tooling spawned by the PaperCut application server process, matching reconnaissance activity observed by Arctic Wolf in education-sector intrusions leveraging CVE-2026-81578 and CVE-2026-82078.
references:
  - https://thehackernews.com/2026/09/attackers-exploit-papercut-flaws-to.html
  - https://attack.mitre.org/techniques/T1033/
  - https://attack.mitre.org/techniques/T1087/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1087.002
  - attack.t1018
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\PaperCut MF\'
      - '\PaperCut NG\'
  selection_cmd:
    Image|endswith:
      - '\whoami.exe'
      - '\systeminfo.exe'
      - '\ipconfig.exe'
      - '\netstat.exe'
      - '\nltest.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\quser.exe'
      - '\arp.exe'
      - '\nbtstat.exe'
  condition: selection_parent and selection_cmd
falsepositives:
  - Rare — PaperCut health-check or monitoring scripts may invoke some of these; validate against change records
level: high
---
title: Potential LSASS Credential Access From PaperCut Server Host
id: 5b1d8e63-7f4a-4c29-9d3e-6a8b1f47c2e9
status: experimental
description: Detects suspicious access to LSASS memory on hosts running PaperCut NG/MF, consistent with credential theft activity reported in active exploitation of CVE-2026-81578 and CVE-2026-82078. Deploy on PaperCut application servers.
references:
  - https://thehackernews.com/2026/09/attackers-exploit-papercut-flaws-to.html
  - https://attack.mitre.org/techniques/T1003.001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1FFFFF'
  filter_known:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\svchost.exe'
      - '\wininit.exe'
  condition: selection and not filter_known
falsepositives:
  - Legitimate EDR/AV and backup agents accessing LSASS — tune SourceImage allowlist for your stack
level: high

KQL — Microsoft Sentinel / Defender

Hunt for PaperCut server processes spawning shells or recon tooling across your fleet. If you ingest Linux syslog from PaperCut hosts, extend with a Syslog query on shell spawns under the papercut service user.

// Hunt: PaperCut application server spawning shells or reconnaissance tooling
// Covers post-exploitation pattern from CVE-2026-81578 / CVE-2026-82078 intrusions
let reconBinaries = dynamic(["whoami.exe","systeminfo.exe","ipconfig.exe","netstat.exe","nltest.exe","net.exe","net1.exe","quser.exe","nbtstat.exe","arp.exe"]);
let shells = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe"]);
DeviceProcessEvents
| where InitiatingProcessFolderPath has_any ("PaperCut MF", "PaperCut NG")
   or InitiatingProcessFileName =~ "pc-app.exe"
| where FileName in~ (reconBinaries) or FileName in~ (shells)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName, ReportId
| sort by TimeGenerated desc;

// Companion: outbound network connections from the PaperCut process to non-print infrastructure
// Useful for spotting C2 or exfil staging after exploitation
DeviceNetworkEvents
| where InitiatingProcessFolderPath has_any ("PaperCut MF", "PaperCut NG")
   or InitiatingProcessFileName =~ "pc-app.exe"
| where RemotePort !in (80, 443, 9191, 9192, 9193, 515, 631, 9100)
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, RemotePort
| sort by ConnectionCount desc;

Velociraptor VQL

Use this hunt artifact across your PaperCut application servers to surface anomalous child processes and unexpected outbound connections from the service context.

-- Hunt: Suspicious child processes and network connections from PaperCut service
-- Target PaperCut NG/MF application servers for CVE-2026-81578 / CVE-2026-82078 post-exploitation

LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)PaperCut (MF|NG)' OR Name =~ '(?i)pc-app|java'

LET suspicious_children = SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Ppid in (SELECT Pid FROM procs)
  AND Name =~ '(?i)cmd|powershell|pwsh|whoami|netstat|systeminfo|nltest|net1?\.exe|wscript|cscript|mshta|rundll32|sh$|bash$|dash$'

LET suspicious_net = SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Pid in (SELECT Pid FROM procs)
  AND Status =~ 'ESTABLISHED'

SELECT * FROM suspicious_children
UNION ALL
SELECT Pid, Name, Raddr AS Exe, Laddr AS CommandLine, '' AS Username FROM suspicious_net

Remediation & Verification Script

Run this on Windows PaperCut application servers to confirm installed version, identify risky exposure (listeners bound externally), enumerate suspicious recent child-process artifacts in logs, and apply compensating hardening if you cannot patch immediately.

# PaperCut CVE-2026-81578 / CVE-2026-82078 — Verification & Hardening Script
# Run elevated on each PaperCut NG/MF application server

# 1. Identify installed PaperCut version
$pcPaths = @("C:\Program Files\PaperCut MF", "C:\Program Files\PaperCut NG")
foreach ($p in $pcPaths) {
    if (Test-Path $p) {
        Write-Host "[+] Found installation: $p"
        $verFile = Get-ChildItem $p -Recurse -Filter "version.properties" -ErrorAction SilentlyContinue | Select-Object -First 1
        if ($verFile) { Get-Content $verFile.FullName }
        Get-Item "$p\server\bin\pc-app.exe" -ErrorAction SilentlyContinue |
            Select-Object FullName, @{N='FileVersion';E={$_.VersionInfo.FileVersion}}
    }
}

# 2. Check exposure: is the web interface listening on all interfaces?
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -in 9191,9192,9193 } |
    Select-Object LocalAddress, LocalPort, OwningProcess |
    Format-Table -AutoSize

# 3. Compensating control: restrict admin web UI to localhost/management subnet (if unpatched)
# Adjust -RemoteAddress to your management network; REMOVE these rules after patching
New-NetFirewallRule -DisplayName "PaperCut-AdminUI-Restrict-9191" -Direction Inbound -Protocol TCP -LocalPort 9191 -RemoteAddress "10.0.10.0/24" -Action Allow -ErrorAction SilentlyContinue
New-NetFirewallRule -DisplayName "PaperCut-AdminUI-Block-9191" -Direction Inbound -Protocol TCP -LocalPort 9191 -Action Block -ErrorAction SilentlyContinue
New-NetFirewallRule -DisplayName "PaperCut-AdminUI-Restrict-9192" -Direction Inbound -Protocol TCP -LocalPort 9192 -RemoteAddress "10.0.10.0/24" -Action Allow -ErrorAction SilentlyContinue
New-NetFirewallRule -DisplayName "PaperCut-AdminUI-Block-9192" -Direction Inbound -Protocol TCP -LocalPort 9192 -Action Block -ErrorAction SilentlyContinue

# 4. Hunt local process-creation telemetry (4688 with command line) for suspicious PaperCut children
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 20000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'PaperCut (MF|NG)' -and $_.Message -match 'cmd\.exe|powershell\.exe|whoami\.exe|netstat\.exe|nltest\.exe|mshta\.exe|rundll32\.exe' } |
    Select-Object TimeCreated, Message | Format-List

# 5. Verify the PaperCut service account — it should NOT be a Domain Admin or highly privileged
Get-CimInstance Win32_Service -Filter "Name LIKE '%PaperCut%'" |
    Select-Object Name, StartName, State, PathName | Format-List

Remediation

1. Patch immediately. Upgrade PaperCut NG/MF to the fixed release identified in PaperCut's security bulletin covering CVE-2026-81578 and CVE-2026-82078. Consult the official advisory at the PaperCut security bulletin portal (papercut.com/kb and the vendor's published security advisory for these CVEs) for the exact fixed version for your product line. Do not rely on "we'll patch in the next maintenance window" — exploitation is confirmed and ongoing.

2. If you cannot patch today, remove exposure. Take the application server web interface off any internet-facing or broadly reachable network path. Restrict TCP 9191/9192/9193 to a dedicated management VLAN via host firewall and network ACLs (see script above). This breaks the unauthenticated exploitation path's reachability requirement but is not a substitute for patching.

3. Assume compromise and hunt retroactively. Given confirmed in-the-wild exploitation, deploy the Sigma, KQL, and VQL content above against at least 30 days of retained telemetry on every PaperCut host. Look specifically for the PaperCut process spawning shells, recon commands, and any unexpected outbound connections from the server.

4. Rotate credentials. Because credential theft is the stated objective of this campaign, rotate: (a) the PaperCut service account, (b) the LDAP/AD bind account PaperCut uses for directory integration, (c) any local admin credentials on the PaperCut host, and (d) any credentials of users who administered the server from it. Treat any domain account that authenticated interactively on that host as potentially exposed.

5. Reduce service-account privilege. The PaperCut service should run as a dedicated, least-privilege domain account — never Domain Admin, never a member of privileged groups. This sharply limits the blast radius of the RCE even if a future flaw is exploited.

6. Segment print infrastructure. Print servers should sit in a dedicated segment with egress filtering. There is rarely a legitimate reason for a print management server to initiate outbound connections to arbitrary public IPs — block and alert on it (second KQL query above).

7. Monitor for CISA KEV addition. Track both CVEs in the CISA Known Exploited Vulnerabilities catalog. A KEV listing will carry a federal remediation deadline and is a strong signal to accelerate any remaining patch exceptions.

8. Education-sector specific: if you are a university running PaperCut across departments or student print labs, inventory every instance including department-managed shadow deployments — those decentralized installs are exactly where unpatched servers live, and where attackers in this campaign are finding them.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub