Critical PaperCut Zero-Day Exploits Under Active Attack: CISA Issues Urgent Patch Directive

Executive Summary

On August 31, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities in PaperCut NG and MF print management software to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2026-81578 and CVE-2026-82078, these flaws allow unauthenticated attackers to achieve remote code execution (RCE) on vulnerable servers. With approximately 100 million users across 70,000 organizations, the potential impact of this campaign is significant, particularly for state agencies and educational institutions.

Threat Analysis

Threat actors are actively chaining these two vulnerabilities to bypass authentication and execute arbitrary code. The exploitation pattern suggests a focus on data theft and potential lateral movement within enterprise networks. Given the widespread use of PaperCut in high-value environments, the threat level is classified as critical. Attackers are targeting internet-facing instances, with a high concentration of vulnerable servers identified in North America and Europe.

Technical Details

CVE-2026-81578 is an authentication bypass vulnerability with a CVSS v3.1 score of 8.8, allowing attackers to modify system configurations without valid credentials. When chained with CVE-2026-82078, an attacker can gain full remote code execution on the underlying server. This combination effectively grants the attacker SYSTEM-level access, enabling the deployment of malware, exfiltration of sensitive print data, and further compromise of the internal network infrastructure.

Attribution Assessment

While specific threat actor groups have not been publicly named in this latest campaign, the methodology mirrors previous attacks on PaperCut infrastructure, which have historically been linked to ransomware syndicates such as LockBit and Clop, as well as state-aligned actors like Muddywater. The speed at which these vulnerabilities were weaponized following discovery indicates a sophisticated, well-resourced adversary.

Implications

Organizations relying on PaperCut NG or MF are at immediate risk of data breach and system takeover. The inclusion of these flaws in the CISA KEV catalog mandates that federal agencies prioritize patching under Binding Operational Directive 26-04. Failure to patch leaves the organization exposed to automated exploitation tools currently circulating in the wild.

Recommendations

1. Immediate Patching: Apply the latest security updates provided by PaperCut Software to all instances of NG and MF immediately.
2. Network Segmentation: Restrict access to the PaperCut web interface to trusted internal networks only; disable public-facing access where possible.
3. Monitoring: Review server logs for unauthorized configuration changes or suspicious process execution originating from the PaperCut service account.
4. Incident Response: Assume potential compromise if the server was internet-facing prior to patching and initiate threat hunting procedures.