The vulnerability chain
CVE-2026-81578 is an improper access control flaw in the web management interface of PaperCut MF and NG that lets an unauthenticated attacker reach administrative functions they should never be able to see. CVE-2026-82078 is a separate unsafe dynamic class loading vulnerability in the product's database connection utilities. Chained together, the pair lets an attacker bypass authentication entirely, modify system configuration, and execute arbitrary Java bytecode on the server with no credentials required at any point in the attack sequence.
That combination is a severe outcome for a piece of infrastructure most IT teams treat as a low priority utility somewhere near the bottom of the patch queue. PaperCut sits on the internal network, is typically domain-joined for authentication purposes, and often runs with elevated service account privileges to manage print queues across an entire organization's offices and departments. A remote code execution bug in that specific position converts a boring print management tool into a foothold that reaches directly into the parts of the network that actually matter, including Active Directory itself.
Three independent teams found exploitation before most customers knew to look
Huntress analysts identified evidence of exploitation in two customer environments during their routine incident investigations. Separately, the threat intelligence firm Defused observed exploit activity hitting its honeypots starting August 29, showing broad opportunistic scanning against anything running the vulnerable software rather than a small, hand-picked list of targets. WatchTowr researchers then found something more concerning still: multiple bypasses for PaperCut's initial patch, plus an entirely separate authentication bypass the vendor had not addressed in either of its first two fixes.
That triangulation across three independent research teams matters because it means the exploitation was happening at real volume, across many unrelated organizations, while PaperCut was still working through the process of shipping a complete fix. Security teams that waited for a single vendor advisory before checking their own logs were, in practical terms, checking too late for anyone who had already been hit during that first exposure window, and honeypot data suggests that window opened well before most customers had any reason to be watching for it.
What attackers do once they are in
Post-compromise behavior followed a consistent, efficient playbook across the observed cases. Attackers enumerated users, privileges, and domain controllers almost immediately after gaining access, indicating they were mapping the broader Active Directory environment rather than treating the print server as an isolated target worth compromising on its own. They then installed SimpleHelp configured to auto-start, giving them a persistent remote access channel that survives reboots, and layered AnyDesk on top as a second, redundant access path in case the first tool was discovered and removed by an alert administrator.
In the fastest observed cases, a separate IP address accessed a deployed web shell using the correct encryption key within eighteen seconds of it being planted on the server. That speed reflects pre-staged, automated infrastructure waiting to pick up newly compromised hosts the moment they come online, rather than a human operator manually checking back on a list of targets. It tells you the group behind this campaign has industrialized the handoff between initial access and follow-on exploitation well beyond what opportunistic, manually operated hacking typically looks like.
Three patch rounds in a week is its own warning sign
PaperCut's response timeline shows the difficulty of closing a vulnerability chain cleanly under pressure and public scrutiny: an initial warning on August 27, emergency patches on August 28, extended indicators of compromise on August 30, and a third round of patches on September 2. Each round responded to new bypasses that researchers found in the previous one, which means customers who patched immediately after the first advisory, doing exactly what a responsible security team should do, were still exposed for days afterward through no fault of their own.
This pattern, seen now across multiple vendors this year, argues against treating the first available patch as the finish line for a critical vulnerability. Security teams should track whether a vendor issues follow-up bypass disclosures for at least a week or two after any emergency patch, and re-verify exposure rather than closing the incident ticket after the initial fix, since that extra verification step costs little compared to the alternative of assuming remediation when a bypass is still live.
Why print infrastructure deserves identity-provider-level scrutiny
Most attack surface management programs rank assets by the data they directly hold, which puts customer databases and payment systems at the top of the priority list and print servers somewhere near the bottom, often grouped in with general office equipment. That ranking misses how attackers actually think about value. A print server is valuable to an intruder precisely because it is under-monitored, domain-joined, and treated as boring infrastructure that nobody on the security team watches closely for anomalous behavior or unusual outbound connections.
If your organization runs PaperCut or any comparable print management platform, it belongs in the same monitoring and patch-priority tier as your identity provider and VPN concentrators, rather than sitting in the general IT operations bucket managed by a help desk team with different priorities. The privilege level and network position of a print server closely resemble those of higher-profile identity infrastructure, even though the perceived business criticality on a typical asset inventory spreadsheet does not reflect that resemblance at all.
The decision this puts on your desk
Confirm you are on PaperCut's latest patch round from September 2, not just the first emergency fix from late August, and pull logs covering the full window back to August 27 rather than assuming a clean bill of health from a single point-in-time check performed weeks ago. Look specifically for SimpleHelp or AnyDesk installations your team did not provision through normal change management, since those two tools are the specific persistence mechanisms this campaign consistently relies on across the cases researchers have documented so far.
More broadly, use this incident to rerun your asset inventory with a question your current risk model probably is not asking today: which of our domain-joined utility servers, whether print, backup, monitoring, or something else entirely, would give an attacker meaningful lateral movement into Active Directory if compromised on its own. Those are precisely the assets that deserve identity-provider-grade monitoring and patch urgency, even though none of them will ever show up as your highest-value data store on a conventional risk register.
