PaperCut Attacks Are Stealing Credentials From Education Networks
Researchers have now documented credential theft and privileged-account creation after attackers exploited two PaperCut flaws. Schools and universities should patch, restrict exposure and hunt for compromise rather than treating the update alone as proof they are clean.
The short version
What you need to know
- Arctic Wolf says it observed CVE-2026-81578 and CVE-2026-82078 being used for command execution, reconnaissance, privileged-account creation and credential collection on PaperCut servers.
- PaperCut tells operators to restrict public web access to trusted addresses immediately and says every internet-facing Application Server should receive Emergency Patch Release 3, even if an earlier emergency release is already installed.
- A consumer VPN app cannot patch or investigate an organisation's print-management server. A controlled administrative VPN can reduce public exposure only when it is correctly designed and paired with patching, access controls and incident response.
What has changed in the PaperCut warning?
PaperCut disclosed active exploitation in late August, but new Arctic Wolf findings add concrete post-compromise evidence. The research team says attackers chained the PaperCut NG and MF flaws CVE-2026-81578 and CVE-2026-82078 against education-sector organisations in the United States and Europe.
Arctic Wolf observed discovery commands, attempts to create a privileged account, searches of PaperCut configuration files for passwords and tokens, Windows registry-hive collection tools and Meterpreter-related Java payloads. These are observed actions in investigated environments; they do not show that every unpatched PaperCut server has been compromised.
What PaperCut administrators should do now
PaperCut says any NG or MF Application Server reachable from the public internet should have web access restricted to trusted IP addresses immediately. Its current advisory recommends Emergency Patch Release 3 for every internet-facing Application Server, including systems that already received an earlier emergency patch. Customers on versions before v24 are directed to upgrade to the latest version.
Do not stop after installing the update. Arctic Wolf recommends checking PaperCut server logs for the vendor's exploitation strings, looking for short unexpected class, command and output files, reviewing pc-app.exe spawning command interpreters, and investigating unexpected privileged accounts or credential-collection tools. Use the full vendor and researcher guidance rather than copying indicators into a blocklist without context.
Why staff and students should care
A print server can connect to identity services and sit inside a wider school or university network. Arctic Wolf warns that stolen logins could provide a path into other systems, which is why administrators need to review accounts, tokens and affected hosts rather than assume this is only a printer problem.
Ordinary users should follow their institution's incident instructions. Be cautious with unexpected password-reset messages, sign-in prompts or support calls, and verify them through the institution's known helpdesk. Do not infer that your own account was stolen unless the organisation confirms it or you see credible account alerts.
Where a VPN helps — and where it does not
An organisation can place a management interface behind a properly configured administrative VPN or another controlled access path so it is not directly exposed to the public internet. That is a network-design control operated by the institution, not the same thing as installing a personal VPN app on a staff laptop.
A consumer VPN cannot update PaperCut, remove attacker-created accounts, rotate exposed credentials or prove that a server is clean. Restricting exposure, installing the current vendor release, reviewing evidence and following incident-response procedures are the relevant actions.
VPN Rocks view
The important update is not simply that exploitation exists; it is that defenders now have evidence of credential-focused follow-on activity. Internet-facing operators should treat this as both a patching task and a compromise-assessment task.
For everyone else, the lesson is about precise layers of defence. A controlled remote-access path can reduce exposure, but it never turns a vulnerable or already compromised server into a safe one.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.
