GoKawiilAttackers exploit patched PaperCut flaws to steal data from print servers
Hackers are actively exploiting two recently disclosed PaperCut NG and MF vulnerabilities, CVE-2026-81578 and CVE-2026-82078, to bypass authentication and steal data from print management servers. PaperCut issued emergency fixes last week, but researchers at Defused say attackers are using the bypass to hijack the software's user-lookup function and dump database tables rather than pursue remote code execution as earlier reports suggested. Over 800 PaperCut servers remain exposed online according to Shadowserver, and PaperCut has not yet attributed the attacks or detailed post-compromise activity.
GoKawiil's interpretation of the reporting above, not reported fact.
PaperCut runs on servers for roughly 100 million users across 70,000 organizations, including government agencies and schools, making this a high-value target similar to the 2023 PaperCut flaws that were chained by ransomware groups like LockBit. The shift toward direct database theft rather than full remote code execution suggests attackers may be prioritizing quick data exfiltration over establishing persistent footholds, raising urgency for organizations to patch immediately.
- Two chained PaperCut vulnerabilities allow authentication bypass and remote code execution on print servers.
- Active exploitation now focuses on stealing database contents via the software's Derby database rather than full RCE.
- Over 800 PaperCut servers remain publicly exposed, echoing past ransomware campaigns against the software.
Yubico YubiKey 5 NFC Security Key — When attackers chain authentication bypasses like the PaperCut flaws, hardware-backed logins are one of the strongest defenses admins can add to their management consoles and accounts. The YubiKey 5 NFC plugs into USB-A or taps on a phone and supports FIDO2/WebAuthn, OTP, and smart card protocols, so IT teams can lock down admin access without relying on passwords alone.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-01
Published there as: “Recently patched PaperCut zero-days used in data theft attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.