PaperCut Ships Maintenance Releases for Actively Exploited CVEs-2026-81578 and CVE-2026-82078

PaperCut issued regular maintenance releases after emergency patches for CVE-2026-81578 and CVE-2026-82078 proved insufficient. The flaws allow unauthenticated attackers to execute arbitrary code on print-management servers. Customers running any of the three emergency builds must now migrate to the QA-tested maintenance versions that bundle additional hardening.

GreyNoise and Blackpoint Cyber telemetry shows the campaign originated from 45.142.193.132 and deliberately excluded Russia, China, Hong Kong, Thailand, Iran and 23 other jurisdictions. The actor used AI agent swarms to scan and compromise targets at scale, concentrating on U.S. education networks. At least 395 organizations across 48 countries were reached before the maintenance releases appeared.

The operation demonstrates how commodity large-language-model tooling lowers the barrier for initial-access brokers. By automating reconnaissance and exploit chaining, the actor achieved volume without exposing novel zero-days, a pattern now visible in multiple 2025-2026 campaigns against edge devices and management platforms.

Unpatched PaperCut instances remain reachable from the same infrastructure. Organizations should verify build numbers immediately; failure to move beyond emergency patches within seven days will leave systems exposed to follow-on ransomware or access hand-off.