PaperCut NG/MF Active Exploitation Confirmed via CVE-2026-82078 and CVE-2026-81578

PaperCut disclosed confirmed customer incidents on Thursday and released an initial patch that failed to fully mitigate the issues, requiring a second release Friday after collaboration with Huntress and watchTowr. The flaws allow unauthenticated remote code execution on the web management interface, enabling initial access followed by credential harvesting or ransomware deployment.

Huntress reported at least two impacted customers while watchTowr noted prior PaperCut bugs were leveraged by Bl00dy and Clop ransomware operators. The 2023 CISA advisory AA23-129a specifically flagged K-12 schools as high-risk due to widespread public exposure of the software; Microsoft separately attributed similar exploitation that year to an Iranian infrastructure-targeting group.

The pattern shows print management platforms function as both perimeter pivots and document exfiltration points. Organizations ignoring the directive to restrict web interfaces to trusted IPs will continue to serve as low-friction entry vectors for both opportunistic and state-aligned actors.

Expect continued scanning and exploitation attempts against unpatched instances through the next 30 days, with ransomware affiliates likely to incorporate the new CVEs into existing playbooks within two weeks.