On 27 August 2026, PaperCut disclosed active exploitation affecting its self-hosted NG and MF print-management products. Two vulnerabilities were later made public: CVE-2026-81578, an authentication-bypass flaw in the web management interface, and CVE-2026-82078, an unsafe dynamic class-loading issue in the database connector. Together, they created a path from an unauthenticated web request to configuration changes and, under the right conditions, arbitrary Java code execution in the security context of the PaperCut server.
The affected systems are not ordinary web applications. PaperCut NG and MF are commonly domain-joined, integrated with Active Directory, and run with high privileges on Windows. A compromise can therefore become an identity and domain problem very quickly.
From disclosure to an AI-orchestrated campaign
GreyNoise reported that on 31 August a likely Russian-speaking actor used the two vulnerabilities while developing and testing an attack chain. The actor built a lab with PaperCut and Active Directory, generated target lists through an internet-scanning service, and used hundreds of AI agents powered by a DeepSeek model through the OpenAI Codex harness to coordinate exploitation and post-compromise activity.
According to GreyNoise, the campaign opportunistically compromised at least 440 PaperCut instances belonging to 395 identified organizations across 48 countries. The operation moved from an empty workspace to remote code execution against a real victim in under four hours. Once launched at scale, it compromised at least 11 organizations in 26 seconds. GreyNoise observed domain-administrator access at 12 organizations; in the fastest case, that escalation took five minutes.
The routes to domain control were familiar. The actor harvested LSASS memory and registry secrets, used pass-the-hash, exploited unpatched Active Directory weaknesses, and took advantage of PaperCut services already running with excessive privileges. AI did not invent these techniques. It compressed the time needed to combine, adapt, and run them across many targets.
What worked — and what did not
GreyNoise noted that the campaign did not succeed uniformly. In at least one case, Cloudflare's Web Application Firewall blocked the attacker. Endpoint controls and rapid investigation also limited damage at some organizations. These details matter: AI-enabled attacks still encounter conventional controls, and basic hardening remains effective.
PaperCut has published security maintenance releases 26.0.5, 25.0.13, and 24.1.10, replacing the emergency patches. Organizations should upgrade immediately, review PaperCut's current indicators of compromise, investigate suspicious child processes launched by pc-app.exe, and assume that missing artifacts do not prove a system is clean. Where exposure is operationally unavoidable, access should sit behind appropriate authentication, network controls, monitoring, and a tightly restricted service identity.
The first control failure happened before exploitation
The vulnerabilities explain how the campaign entered. They do not explain why so many valuable targets were available to enter.
The first security problem was exposing an application like PaperCut directly to the public internet. A domain-connected print-management server with privileged access is an administrative system, not a public web service. Patching is essential, but patching alone cannot compensate for an architecture that gives any internet user a direct path to a high-value management interface.
The practical lesson is to treat internet exposure as a continuously reviewed exception. Minimize the attack surface, place management interfaces behind controlled access, restrict service privileges, and monitor the identities and processes around the application. The AI orchestration in this campaign is significant, but the defensive conclusion is old and durable: remove the opportunity before racing the attacker to the next patch.