Arctic Wolf Reports Active Exploitation of PaperCut Vulnerabilities in Education Sector

According to the Arctic Wolf Adversary Research Team, threat actors are actively exploiting two newly disclosed vulnerabilities in PaperCut software to target the education sector. The vulnerabilities, identified as CVE-2026-81578 and CVE-2026-82078, were reported to be chained together: CVE-2026-81578 provides an authentication bypass, and CVE-2026-82078 enables remote code execution.

The attacks have been observed against schools and universities in the U.S. and Europe. Using the exploitation chain, attackers can execute commands on affected servers and conduct reconnaissance. The primary objective appears to be credential theft, which could lead to unauthorized access to sensitive student and staff data.

PaperCut NG and PaperCut MF are the affected products. The vendor has released security updates addressing the flaws. Arctic Wolf reports that the exploitation was observed starting around early September 2026. The firm notes that while the attack pattern aligns with education-sector targeting, specific attribution, the number of compromised institutions, and the exact data exfiltrated remain unconfirmed and require further investigation.