AI-Driven Exploitation of PaperCut Vulnerabilities Compromises 440 Servers Globally

• •Exploited vulnerabilities CVE-2026-81578 and CVE-2026-82078 in PaperCut software.
• •At least 440 instances compromised across 395 organizations in 48 countries.
• •AI agents enabled rapid exploitation, achieving RCE in under four hours.

A Russian-speaking threat actor has exploited vulnerabilities CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF software, compromising at least 440 instances across 395 organizations in 48 countries. The campaign began on August 31, 2026, utilizing hundreds of AI agents powered by OpenAI's Codex and DeepSeek models to automate the attack process. The adversary achieved remote code execution (RCE) within four hours of initial exploit development and gained domain administrator access in as little as seven minutes. Most victims are in the education sector, with the United States being the most affected country. Despite attempts to avoid targeting specific countries, some organizations in those regions were still compromised. GreyNoise and Blackpoint Cyber have reported on the incident, emphasizing the rapid scale and sophistication of the attacks. Emergency patches were issued by PaperCut on August 27, 2026, prior to the exploitation.