Vulnerability · Patch Management

AI-Powered Attack Exploited PaperCut Flaws to Hack 395 Organizations

September 11, 2026 · 6 min read

On August 26, 2026, a threat actor began probing PaperCut NG and MF servers using two zero-day vulnerabilities that had no patch yet. By August 31, the same actor had spun up hundreds of AI agents running on OpenAI Codex and DeepSeek, handed them access to the Netlas internet scanning platform, and turned what had been careful reconnaissance into an automated breach machine. Within 26 seconds at peak execution, 11 organizations were compromised. By the time researchers finished counting, 440 PaperCut instances belonging to 395 distinct organizations across 48 countries had been hit. The speed and scale here are worth sitting with for a moment, because this campaign shows what AI-assisted exploitation looks like when it is pointed at a product that sits on tens of thousands of networks and faces the internet.

What actually happened

The two vulnerabilities at the center of this campaign are CVE-2026-81578 and CVE-2026-82078, both affecting PaperCut NG and MF. CVE-2026-81578 carries a CVSS score of 8.8 and is an authentication bypass in the PaperCut web management interface. An unauthenticated remote attacker can reach it and modify system configurations without any credentials at all. CVE-2026-82078 scores 9.4 and represents an unsafe dynamic class loading flaw in the database connection utilities that enables arbitrary Java code execution. Chained together, the two flaws produce a pre-authentication remote code execution path: the first opens the door to config modification, and the second converts that access into full code execution with no login required.

PaperCut Software disclosed both vulnerabilities on August 27, 2026, one day after Huntress detected the first known attack activity in the wild. Emergency Patch Release 2 arrived on August 28, and a second emergency patch (Release 3) followed on September 1. CISA added both CVEs to the Known Exploited Vulnerabilities catalog on August 31, the same day the broader AI-driven campaign formally launched. That timeline means the window between first exploitation and a widely distributed patch was measured in days, and the campaign was already moving at machine speed inside that window.

What made this campaign different from a typical exploitation wave was the automation behind it. The threat actor, assessed as likely Russian-speaking based on GreyNoise attribution indicators, used hundreds of AI agents to build, test, and refine exploits, then deploy them at scale. The agents used Netlas to generate target lists of exposed PaperCut servers. According to reporting based on GreyNoise and Blackpoint Cyber intelligence, the attacker went from an empty workspace to first achieving RCE against a real victim in under four hours, and reached first domain administrator access roughly two hours after that. At peak tempo, 11 organizations were compromised in 26 seconds. All traffic traced back to a single IP address, 45.142.193[.]132, which had been linked to port scanning and brute-force attempts in the weeks prior. The attacker harvested credentials and domain secrets and obtained administrator privileges at 12 organizations across the campaign.

"The adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours." — The Register, citing campaign timeline data

The education sector absorbed the largest share of the damage: 204 of the 440 compromised instances belonged to educational organizations, roughly 46 percent of the total. GreyNoise attributes that concentration to PaperCut's customer base composition rather than deliberate targeting. The US led all countries with 98 victim organizations, followed by the UK at 59. France, Spain, and Canada also appeared among the 48 affected countries. Beyond education, the campaign touched retail and professional services, real estate and hospitality, IT and managed service providers, non-profits, libraries, and manufacturing and utilities.

Why this should matter to you even if you don’t run PaperCut

If your environment does not run PaperCut, there are still two things worth taking from this incident. The first is that print management software is a persistent blind spot in many enterprise patch programs. It rarely appears on the short list of high-priority patching targets, and when zero-days land in it, organizations are often caught in a slow reaction posture. PaperCut is widely deployed across education, healthcare, legal, and corporate environments precisely because it solves a real operational problem well. That broad deployment makes it a high-value target when vulnerabilities surface.

The second issue is harder to dismiss with a network topology argument: AI-assisted exploitation has crossed from theoretical concern into documented, large-scale operational use. The attacker in this campaign did not write a single exploit by hand and wait for it to propagate. Instead, the pipeline built, tested, and deployed exploits autonomously, then used internet scanning to find targets and execute at a pace no human team could match. Eleven organizations compromised in 26 seconds is a figure that should recalibrate your assumptions about how long you have to respond after a vulnerability disclosure.

The combination of pre-authentication RCE and AI-driven mass exploitation collapses the timeline that most patch programs assume. A 30-day patch SLA, which was already under pressure from prior campaigns, is now a liability when the exploitation side of the equation can go from disclosure to mass compromise inside a week. Organizations that rely on perimeter controls or network segmentation as a primary compensating control for unpatched internet-facing applications will find those controls tested harder and faster than they were designed for.

The control that would have blunted it

The control that would have blunted this campaign is straightforward to name and genuinely hard to execute consistently: a documented, enforced patch SLA for internet-facing applications, with shorter timelines for critical and high-severity CVEs. PaperCut published Emergency Patch Release 2 on August 28, one day after disclosure. Organizations that applied that patch before August 31 were outside the window of the AI-driven campaign entirely. Those that took a week or more were in the compromise data.

Cyber insurers increasingly ask about patch management maturity during underwriting, and the questions have gotten more specific. They want to know whether you have defined SLAs by severity tier, whether you have a documented process for emergency patches outside normal change windows, and whether you have visibility into what internet-facing software is actually running in your environment. All three of those requirements are load-bearing in this scenario. You cannot patch PaperCut on an emergency timeline if your asset inventory does not show you that PaperCut is exposed to the internet, and you cannot act on a 48-hour SLA if your change management process requires a two-week approval cycle.

There are real tradeoffs here worth acknowledging. Emergency patching carries operational risk, particularly for print management infrastructure that supports clinical, educational, or manufacturing workflows. A patch applied without adequate testing can break functionality at a bad time. The answer most mature programs land on is a tiered approach: pre-authenticated RCE vulnerabilities with active exploitation evidence get an accelerated track with abbreviated testing, while lower-severity issues stay on the standard schedule. That approach requires prior investment in test environments and documented escalation procedures, which are costs some organizations skip until they appear in an incident after-action report.

Network-level compensating controls matter too, though they are not a substitute for patching. Restricting PaperCut's management interface to internal networks or VPN-only access would have removed these servers from the Netlas-generated target lists the AI agents were working from. Many of the 440 compromised instances were reachable directly from the internet, which is a configuration choice that widens the blast radius of any future vulnerability in that product. Reviewing internet exposure for all administrative interfaces is a reasonable parallel workstream while patches are being tested and deployed.

Strondex's patch management solution helps teams define and enforce severity-tiered patch SLAs, track internet-facing application exposure, and document compliance for cyber insurance underwriting, including support for emergency patching workflows outside standard change windows.