# PaperCut Attackers Are Back — and This Time They're Draining School Credential Stores
The education sector just got handed another reminder that running legacy print management software on a shoestring IT budget is an invitation, not a risk. Threat actors are actively chaining two freshly disclosed PaperCut vulnerabilities — an authentication bypass paired with remote code execution — to harvest credentials from universities and K-12 institutions across the U.S. and Europe, according to the Arctic Wolf Adversary Research Team.
The bugs in question: CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution). Together they form the kind of exploit chain defenders dread — skip the front door entirely, land a shell, and get to work.
## How the Chain Works
PaperCut NG and MF are print management platforms so deeply embedded in higher education that most institutions don't even think of them as attack surface. They just think of them as the thing that lets students print. That invisibility is exactly what attackers exploit.
CVE-2026-81578 allows an unauthenticated attacker to bypass the application's authentication controls entirely — no credentials required to reach administrative interfaces. From there, CVE-2026-82078 provides the lever to execute arbitrary code on the underlying server. Chain them together and you have pre-auth RCE on a server that typically runs with elevated privileges and sits inside the campus network perimeter.
Arctic Wolf's researchers observed attackers using the access for command execution and network reconnaissance — the expected first-stage behavior when the goal is credential theft rather than immediate ransomware deployment. The pattern suggests deliberate collection: understand the network, find the credential stores, extract quietly.
That last part matters. Credential theft without an obvious ransomware payload is often harder to detect and dramatically harder to scope after the fact. Schools won't necessarily know what was taken or when.
## Why Education Gets Targeted Like This
Print management software is a category that IT departments don't patch the way they patch, say, VPN concentrators or Active Directory controllers. It's treated as infrastructure — assumed to be stable, rarely touched, often forgotten in vulnerability scanning cycles. PaperCut specifically has a history of running on servers that haven't seen a maintenance window in years.
The education sector amplifies this problem. University IT teams routinely support tens of thousands of users across dozens of departments with staffing that would make a mid-market company wince. Security operations center coverage is thin or nonexistent at most institutions below the flagship state university tier. K-12 districts are in even worse shape.
Credential theft at an educational institution carries real downstream risk that goes beyond the institution itself. Universities hold research data, faculty and student PII, financial aid records, and — at research hospitals affiliated with academic medical centers — patient data. A compromised credential from a university identity provider can open doors into federal research networks, clinical trial systems, and partner organizations.
## What Arctic Wolf Found in the Wild
The observed attack pattern follows a recognizable playbook: authentication bypass to gain initial access, RCE to establish persistent command execution, then reconnaissance to map the internal environment before moving toward credential targets. The breadth of the campaign — institutions in both the U.S. and Europe — suggests this isn't opportunistic. Attackers with a working exploit for a widely deployed platform in an under-patched sector will work that exploit systematically until it stops yielding results.
PaperCut has issued patches. The question, as always in education, is timeline.
## What Defenders Need to Do Now
For any institution running PaperCut NG or MF, the priority list is short and non-negotiable:
---
## HackWire Analysis
This is not PaperCut's first rodeo. In 2023, the platform was aggressively targeted by Cl0p and LockBit affiliates exploiting CVE-2023-27350 — a critical auth bypass that also enabled pre-auth RCE. The response then was slow across the education sector, patching lagged significantly behind the threat, and institutions paid for it.
Now, three years later, we're watching the same movie with a different CVE number. The attack surface hasn't fundamentally changed. PaperCut is still deeply embedded in campus environments, still under-patched, and still treated as background infrastructure rather than a security-critical system. The question the industry should be asking isn't "why are attackers targeting PaperCut again?" — the answer to that is obvious. The question is why the education sector keeps arriving at these moments unprepared.
Part of the answer is structural. CISA's Known Exploited Vulnerabilities catalog and mandatory patching timelines apply to federal agencies, not universities. There's no equivalent forcing function for higher ed. Institutions that rely entirely on voluntary adoption of security guidance will always lag.
The credential theft angle here deserves more attention than it's getting. When ransomware hits a university, it's visible — operations halt, the press release goes out, recovery is painful but bounded. Credential theft is quieter. Exfiltrated credentials can enable account takeover campaigns, business email compromise, and lateral movement into partner organizations months after the initial compromise. The school may never fully understand what was accessed or where those credentials were used downstream.
For institutions running PaperCut: patch, audit, rotate. In that order, today.
For the sector more broadly: print management software is security-critical infrastructure. Start treating it that way.
— HackWire Editorial
---
## Related Coverage