Exploitation of PaperCut Vulnerabilities Threatens Educational Institutions

• •Two critical vulnerabilities in PaperCut are actively exploited in the education sector.
• •Attackers are using credential harvesting tools and creating unauthorized privileged accounts.
• •Defenders should monitor logs and restrict access to PaperCut management interfaces.

Attackers are exploiting two recently disclosed vulnerabilities in PaperCut, CVE-2026-81578 and CVE-2026-82078, to steal credentials and gain privileged access in educational institutions across the U.S. and Europe. The Arctic Wolf Adversary Research Team reported that threat actors are chaining an authentication bypass with remote code execution to conduct reconnaissance and create privileged accounts. The vulnerabilities were disclosed on August 27, 2026, and added to CISA's Known Exploited Vulnerabilities catalog on August 31. Attackers have been observed using tools like lsa_collect.exe and Meterpreter Java payloads to extract sensitive data and create unauthorized accounts. The exploitation has impacted various educational organizations, from K-12 schools to universities. Defenders are advised to monitor server logs for unusual activity and keep PaperCut management interfaces off the public internet.