IT Security News - Cybersecurity, Infosecurity News

www.itsecuritynews.info • September 6, 2026

The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 – an authentication bypass and remote code execution chain – to conduct command execution and reconnaissance, as well as

Read the original article:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Exploitation of PaperCut Vulnerabilities Threatens Educational Institutions Attackers are exploiting two recently disclosed vulnerabilities in PaperCut, CVE-2026-81578 and CVE-2026-82078, to steal credentials and gain privileged access in educational institutions across the U.S. and Europe. The Arctic Wolf Adversary Research Team reported that threat actors are chaining an authentication bypass with remote code execution to conduct reconnaissance and create privileged accounts. The vulnerabilities were disclosed on August 27, 2026, and added to CISA's Known Exploited Vulnerabilities catalog on August 31. Attackers have been observed using tools like lsa_collect.exe and Meterpreter Java payloads to extract sensitive data and create unauthorized accounts. The exploitation has impacted various educational organizations, from K-12 schools to universities. Defenders are advised to monitor server logs for unusual activity and keep PaperCut management interfaces off the public internet. 3 sources 73

Extracted Entities

CVEs (2)

CVE-2026-81578 CVE-2026-82078

CWE Weaknesses (1)

CWE-287 - Improper Authentication