What are CVE-2026-81578 and CVE-2026-82078 in PaperCut?

CVE-2026-81578 is an authentication bypass vulnerability in PaperCut NG and PaperCut MF that allows an unauthenticated attacker to bypass login controls and access the application without valid credentials. CVE-2026-82078 is a remote code execution (RCE) vulnerability that allows an authenticated attacker to execute arbitrary code on the server. When chained together, these two vulnerabilities allow an unauthenticated remote attacker to execute arbitrary code on any internet-facing PaperCut server: the auth bypass provides access, and the RCE converts that access to server compromise. PaperCut is widely deployed in education institutions and enterprise environments for print management, which is why the attack campaign focused heavily on the education sector.

How were AI agents used in the PaperCut mass exploitation campaign?

According to researchers tracking the campaign, the suspected Russian-speaking threat actor deployed hundreds of AI agents to orchestrate the exploitation of internet-facing PaperCut instances at scale. Unlike traditional automated scanners that simply identify vulnerable hosts, the AI agents handled the full exploitation workflow: scanning for exposed PaperCut instances, confirming vulnerability status, sequencing the auth bypass and RCE chain, establishing persistence, and moving to subsequent targets. This allowed a small number of operators to simultaneously manage hundreds of compromise attempts across multiple countries, compressing the time from CVE publication to mass exploitation from weeks to hours.

Which organizations were affected by the PaperCut AI agent attacks?

The PaperCut AI agent campaign primarily targeted the education sector, including universities, school districts, and higher education institutions. Confirmed victims and targeted organizations span the United States, United Kingdom, France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland — ten countries in total. More than 440 internet-facing PaperCut instances were compromised across these geographies. The education sector concentration is consistent with PaperCut's market dominance in university and school print management environments, where many institutions run internet-facing PaperCut servers for distributed campus printing and lack the dedicated security operations capacity to apply critical patches within days of publication.

What does AI-assisted mass exploitation mean for patch management SLAs?

Traditional patch management SLAs were designed for a threat model where attackers had limited capacity to simultaneously exploit large numbers of targets. A 30-day patch window for critical vulnerabilities made sense when mass exploitation required significant human operator effort and the window between CVE publication and widespread exploitation was typically measured in weeks. AI-assisted exploitation changes this calculus. Campaigns like the PaperCut attack demonstrate that a small team using AI agents can achieve mass exploitation across hundreds of targets in hours, not weeks. For internet-facing applications, organizations should target a patch window of 7 days or less for critical vulnerabilities with public proof-of-concept code — and evaluate whether they can reduce this further for CISA KEV catalog entries.

How does attack surface management detect exposure before exploitation?

Continuous attack surface management platforms scan your internet-facing infrastructure from an attacker perspective, identifying exposed services, their software versions, and their vulnerability status. For a campaign like the PaperCut attack, an effective ASM program would: identify all internet-facing PaperCut instances within the managed scope; detect the installed version and flag those running versions affected by CVE-2026-81578 and CVE-2026-82078; alert the security team within hours of the CVE being published; and track remediation status through to confirmed patch application. This provides visibility that vulnerability scanner schedules and asset inventories often miss — particularly for edge applications that are not covered by standard endpoint management tooling.

Hundreds of AI Agents. 440 Compromised Instances. The PaperCut Attack Redefines Exploitation Speed.

Executive Answer

A suspected Russian-speaking threat actor chained two PaperCut NG/MF vulnerabilities — an authentication bypass (CVE-2026-81578) with a remote code execution flaw (CVE-2026-82078) — and deployed hundreds of AI agents to mass-exploit internet-facing PaperCut instances. More than 440 organizations across 10 countries were compromised, primarily in the education sector. The vulnerability class is not new. What is new is the operational layer: AI agents handled the full exploitation workflow at scale, compressing mass exploitation from weeks to hours. If your patch window for internet-facing critical vulnerabilities is measured in weeks, you are losing the race.

Key Numbers

440+ — Internet-facing PaperCut instances compromised across 10 countries in the campaign.
Hundreds — AI agents deployed simultaneously by the threat actor to orchestrate exploitation at scale.
2 — Vulnerabilities chained: CVE-2026-81578 (auth bypass) + CVE-2026-82078 (RCE). Together, they give unauthenticated remote code execution.
10 countries — US, UK, France, Spain, Canada, Belgium, Portugal, Australia, Germany, Switzerland. Education sector targeted primarily.
Hours — Estimated time from campaign launch to first 440+ compromises. Traditional 30-day patch SLAs do not fit this threat model.
0 — Authentication required for initial exploitation. The auth bypass removes the credential barrier entirely.

The vulnerability chain is not what makes this case significant. The operational scale is.

Two PaperCut NG/MF vulnerabilities — CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution flaw — were discovered and published by researchers in early September 2026. Together, they give an unauthenticated remote attacker code execution on any internet-facing PaperCut server. Auth bypass provides access without credentials. RCE converts that access to full server compromise.

A suspected Russian-speaking actor responded by deploying hundreds of AI agents to mass-exploit internet-facing PaperCut instances. More than 440 organizations across 10 countries were compromised. Education sector institutions bore the majority of the impact.

This is not a novel vulnerability class. Auth bypass plus RCE chains have been a standard attack pattern for years. What is new is what happened after the CVEs were published — the speed and automation with which a small group used AI to operate at the scale that previously required significant human infrastructure.

The Attack Chain

PaperCut NG and MF are print management platforms with significant market share in education and enterprise environments. Many institutions run internet-facing PaperCut servers to support distributed campus printing — a deployment pattern that exposes the application directly to attackers without requiring them to first breach the perimeter.

CVE-2026-81578 is the entry point. An authentication bypass in the PaperCut web interface allows an unauthenticated attacker to access the application without valid credentials. The bypass does not require knowledge of any account or password — it circumvents the authentication mechanism entirely. Once inside, CVE-2026-82078 provides the capability to execute arbitrary code on the underlying server with the privileges of the PaperCut application process.

The combination produces a clean, unauthenticated remote code execution path. In the campaign, the threat actor used post-exploitation access for persistence establishment, lateral movement into the broader network, and — in education sector targets — access to student and staff data stored in or accessible through systems connected to the print management server.

What AI Agents Changed About the Operation

Traditional mass exploitation campaigns require infrastructure: a scanning layer to identify vulnerable targets, an exploitation layer to compromise them, a command-and-control layer to manage compromised hosts, and human operators to coordinate across all three. Scaling this infrastructure to hundreds of simultaneous compromise attempts across ten countries requires significant resources.

The PaperCut campaign bypassed much of that complexity by using AI agents to handle the full exploitation workflow. The agents handled target identification, vulnerability confirmation, exploitation sequencing, initial persistence, and target queuing — tasks that previously required human operator attention at each step.

The practical result: a small number of operators achieved 440+ compromises at a speed and geographic scale that traditional campaigns would have required weeks and a much larger team to accomplish. The attacker capacity constraint shifted from human operator availability to compute capacity.

This is the meaningful change in the threat landscape. The attack technique — auth bypass plus RCE — is the same technique it has always been. The speed at which a small group can exploit it across hundreds of geographically distributed targets is not.

What This Means for Your Patch Window

Enterprise patch management SLAs were designed for a different threat velocity. A 30-day window for critical vulnerabilities made sense when the timeline from CVE publication to widespread exploitation was typically measured in weeks, and mass exploitation required attacker infrastructure that took time to spin up and operate.

The PaperCut campaign ran from CVE publication to 440+ compromised instances in hours. A 30-day SLA means you are patching after the campaign has already concluded and moved on to the next target set.

The implication is not that organizations need to eliminate all patch lag overnight. That is not operationally realistic. The implication is that the patch window that matters most — the one where you are actually racing the attacker — is the first 48 to 72 hours after a critical CVE is published for an internet-facing application. During that window, AI-assisted campaigns like this one can reach every exposed instance in the world.

Two questions every CISO should be able to answer: for each critical CVE affecting an internet-facing application, how long does it take your team to identify which of your systems are affected? And how long from that identification to confirmed patch application? If the combined answer is longer than 48 hours, you are in the tail of the exploitation window, not ahead of it.

What to Check in Your Environment

Identify all internet-facing PaperCut instances and patch immediately. PaperCut has published patches for both CVE-2026-81578 and CVE-2026-82078. If you run PaperCut NG or MF in your environment, confirm the installed version, apply the patches, and verify that the management interface is not directly internet-exposed unless required by your deployment model.

Audit your internet-facing application inventory. The PaperCut attack targeted a specific application that organizations often do not treat as a critical internet-facing service. Print management servers frequently fall outside the scope of standard vulnerability management programs that focus on web applications and endpoint infrastructure. Audit your internet-facing exposure to include any application that can be reached from the public internet — regardless of whether it is considered "core" infrastructure.

Review your patch SLA for internet-facing critical vulnerabilities. If your current process routes new critical CVEs through a standard 30-day remediation track, the PaperCut campaign is a concrete example of why that SLA is not aligned with current exploitation speed. Establish a separate fast-track for internet-facing application CVEs with public proof-of-concept code — a 48-to-72-hour initial impact assessment and a 7-day patch target.

Check for indicators of compromise on PaperCut servers. If you run PaperCut and are not certain of your patch status or the timeline of your exposure, treat any internet-facing instance as potentially compromised and review for indicators: unexpected outbound connections, new scheduled tasks or services, unauthorized admin accounts created in the PaperCut user database, and anomalous network activity from the print server.

Asaf's Take

The PaperCut campaign and the Aurora AI-assisted attack planning case from the prior week are two sides of the same shift. Aurora showed AI being used at the planning layer — generating attack methodology for a specific target. PaperCut shows AI being used at the operational layer — executing that methodology at scale simultaneously against hundreds of targets. Both cases point to the same conclusion: the gap between the speed at which attackers can act on a published vulnerability and the speed at which most organizations can remediate it has widened significantly. The organizations in the PaperCut victim list were not breached because their security teams were negligent. They were breached because the exploitation window they were racing against is now measured in hours, and their patch processes were built for a window measured in weeks. The useful question to ask right now is not "are we patching critical vulnerabilities?" — most organizations are. The useful question is "how long does it actually take us to patch a newly published critical CVE on an internet-facing application?" Time that. Compare it to what you just read. Adjust from there.