PaperCut Exploitation Escalates to Active Intrusions

Background on the PaperCut Vulnerabilities

In early 2026 security researchers identified two critical flaws in PaperCut MF and NG, a popular print management solution used by schools, hospitals and enterprises. The flaws, catalogued as CVE-2026-82078 and CVE-2026-81578, allow unauthenticated attackers to execute arbitrary code on the print server. Initial analysis suggested a remote code execution path that could be leveraged to gain administrative control over the entire network.

The United States Cybersecurity and Infrastructure Security Agency (CISA Known Exploited Vulnerabilities catalog) added both entries to its KEV list in March 2026, signaling that the vulnerabilities were being observed in the wild.

From Proof of Concept to Active Intrusion

At first, most reports described proof of concept exploits shared on public forums. Over the last few months, threat intelligence feeds have documented real‑world campaigns that use these flaws to infiltrate organizations. The SecurityWeek report on PaperCut exploitation outlines how attackers chain the vulnerability with stolen credentials to move laterally across internal networks.

Key indicators of compromise include:

• Unexpected PowerShell commands targeting the PaperCut service
• Outbound connections to known command and control domains
• Creation of new administrative accounts on the print server

Attack Flow Overview

1. Attacker discovers an exposed PaperCut web interface
2. Exploit payload leverages CVE-2026-82078 to achieve code execution
3. Malicious script installs a backdoor and contacts a remote server
4. Adversary uses the foothold to enumerate network shares and credentials
5. Further privilege escalation leads to full domain compromise

Each step aligns with tactics described in the MITRE ATT&CK framework, making detection a priority for security operations teams.

Impact on Affected Sectors

PaperCut is embedded in environments where printing is tightly integrated with authentication systems. Compromise of the print server can expose sensitive documents, patient records, student grades and financial statements. In healthcare, a breach could violate HIPAA regulations, while in education it may breach FERPA requirements.

Recent incidents include:

• A regional hospital network reported unauthorized access to radiology reports after a PaperCut server was compromised.
• A university system experienced a ransomware outbreak that originated from a malicious script delivered via the print management console.

Why Traditional Defenses Missed the Threat

Many organizations treat print infrastructure as a low‑risk asset, placing it outside of regular patch management cycles. As a result, outdated versions of PaperCut remained in production long after vendor patches were released. Network segmentation was often insufficient, allowing lateral movement from the print server to critical assets.

Remediation Guidance from Vendors and Agencies

PaperCut released emergency patches for both CVE‑2026‑82078 and CVE‑2026‑81578 in February 2026. The vendor recommends immediate installation of version 22.3.6 or later. In addition, administrators should:

• Disable external access to the PaperCut web interface unless absolutely necessary.
• Enforce multi‑factor authentication for all administrative accounts.
• Implement network segmentation that isolates the print server from core business systems.
• Monitor for the indicators of compromise listed earlier.

The CVE‑2026‑82078 details page provides technical information on the vulnerable code path, while the CVE‑2026‑81578 analysis includes severity scores and mitigation tips.

Detection Strategies for Security Teams

Effective detection hinges on visibility into both network traffic and endpoint behavior. Recommended steps include:

1. Deploy a next‑generation firewall rule that logs all inbound traffic to the PaperCut management ports.
2. Enable file integrity monitoring on the PaperCut installation directory to catch unauthorized changes.
3. Integrate alerts from endpoint detection platforms that flag PowerShell scripts launched from the PaperCut service account.
4. Correlate logs with threat intelligence feeds that reference the specific CVE identifiers.

Security information and event management (SIEM) solutions can create correlation rules that trigger when a new administrative account is created shortly after a PowerShell execution event.

Role of Threat Hunting

Proactive threat hunting can uncover hidden footholds. Analysts should search for:

• Unusual process trees that start with the PaperCut service.
• Outbound DNS queries to domains associated with known exploit kits.
• Legacy credentials stored in clear text on the print server.

Lessons Learned and Future Outlook

The rapid escalation of PaperCut exploitation underscores a broader shift in attacker focus toward overlooked IT assets. As organizations adopt more specialized software, the attack surface expands. Continuous vulnerability management, combined with a risk‑based approach to patching, is essential.

Looking ahead, security professionals should monitor upcoming advisories from the PaperCut official website and stay engaged with national cyber alerts. Early detection and swift remediation remain the most effective defenses against emerging threats.

By treating print infrastructure with the same rigor as other critical systems, organizations can reduce the likelihood of another active intrusion campaign exploiting similar weaknesses.