PaperCut's Second Major Breach and the Education Sector
History Doesn't Repeat Itself in Cybersecurity, It Reminds You
TLDR of the 2026 Attack:
If you manage the technology department for a school district or university, there's a good chance that PaperCut NG or MF is already operating somewhere in your network. Since it's one of the most widely used print management platforms in education, it's not a surprise that it's a default choice for libraries and administrative offices. That wide reach is exactly why PaperCut has become the targeted piece of software in public sector networks, for the second time in three years.
Recently in late August 2026, PaperCut confirmed two vulnerabilities that, when chained together, become significantly more dangerous:
- CVE-2026-81578 (CVSS 8.8) is an authentication bypass in PaperCut’s web-based admin console. By abusing how Apache handles certain requests, the vulnerability allows a remote unauthenticated attacker with the ability to modify system configurations that should never be exposed in the first place. The request seems to hit a public unauthenticated page while initiating the admin-only functionality behind it.
- CVE-2026-82078 (CVSS 9.4) lets threat actors hijack PaperCut’s database connection settings to run their own malicious code on the server by using the same permissions that PaperCut has itself. It builds directly on top of the first vulnerability: after an attacker messes with the configurations, this vulnerability lets them take control of the server.
An internet-facing PaperCut Application Server may look innocuous, but once an attacker achieves network access to it, they've obtained full remote code execution capabilities without having to also steal credentials. According to two exploitations documented by Huntress, the observed activity only involved system discovery and base64-encoded commands (like whoami and ver), which were used to fingerprint the compromised server.
The main takeaway from this detail is the fact that the attackers were merely conducting recon when they were caught, further emphasizing why network detection matters most in these early moments, when the only sign of trouble might be a handful of recon commands.
On top of that, PaperCut's first patch didn't fully close the door. Researchers found a bypass in that initial fix, forcing PaperCut to release a second emergency patch within the next few days. In other words, if an organization is unaware about the second patch because they assumed the first one did the quick fix, they are still likely exposed and vulnerable.
Not the First Time
If this seems like a déjà vu moment, it's because an almost identical incident occurred in spring of 2023. CVE-2023-27350 was an unauthenticated remote code execution vulnerability affecting PaperCut MF/NG versions 8.0.0 through 22.0.8, which were exploited by multiple threat actors simultaneously.
Chief among them was the Bl00dy ransomware gang, which used the flaw to hit schools and universities running unpatched PaperCut servers. Those in the education sector who had failed to apply the latest patch were the victims of ransomware deployment, data exfiltration and operational shutdowns, all because of a management server that most IT staff would never have identified as a potential attack surface.
The pattern between the 2023 and 2026 incidents is the same: PaperCut's near-universal presence in the education sector makes it a uniquely efficient target. Like shooting fish in a barrel, attackers don't need to investigate which schools use it because they can assume that most of them already do.
Our Recommendations: Your Immediate Actions
If PaperCut NG/MF is anywhere in your environment, it's not a "later this week" task. It's a today problem that needs to be addressed. Right now, you can do the following:
- Confirm that both emergency patches are applied. Check your installed version against PaperCut's official security bulletin, because just having the first patch alone will still leave you exposed.
- Get the Application Server off the open internet. If remote access is legitimately needed, restrict it to a VPN or a tightly scoped allowlist of trusted IPs.
- Review logs from late August 2026 forward for signs of the reconnaissance activity mentioned above: base64-encoded command strings or unusual configuration changes to the application server.
How Scinary Can Help
Patching works, but only if it's addressing vulnerabilities that you're already aware of. The uncomfortable truth in both the 2023 and 2026 incidents is that the actual damage came from what happened after initial access and not necessarily the remote code execution exploit itself.
This is where visibility matters as much as patching. When we see something, we say something. Since our Centurion NDR platform monitors traffic across your network, instances like initial access and lateral movement are exactly the kind of suspicious behavior we’re watching to catch. Our 24/7/365 SOC teams are assigned to monitor your Centurion and they’re the ones who will report to you immediately when they notice a legitimate server suddenly running discovery commands or a print server talking to a file share it has no business reaching.
The lesson from PaperCut, taught twice, is that any publicly facing application can become the entry point for a much larger incident. When a security advisory comes out, you're doing the standard vulnerability management work of locking a door once you've been told the lock was faulty. We're here to catch the attacker who's already testing doors you never knew were unlocked.
