Two critical vulnerabilities in PaperCut servers, CVE-2026-81578 and CVE-2026-82078, are being actively exploited, allowing attackers to execute commands, steal credentials, and potentially create privileged accounts within victim networks.
Recent reports from Arctic Wolf Threat Intelligence indicate that these vulnerabilities are being exploited to compromise networks via vulnerable PaperCut print-management servers, thereby escalating post-exploitation activities.
In a clear indication of the severity of this threat, PaperCut confirmed that active exploitation began on August 27, 2026, and that CVE identifiers were assigned the next day. By August 31, the vulnerabilities were included in CISA’s Known Exploited Vulnerabilities catalog.
The impact of these vulnerabilities is significant because PaperCut servers are often embedded in enterprise environments, granting access to critical services such as Active Directory and sensitive authentication settings.
Hackers Exploit PaperCut Command Execution Flaws
After compromising affected PaperCut servers, attackers typically execute common discovery commands to gather information about the operating environment.
Commands like whoami, ver, tasklist, and `uname -a’ are used to identify the compromised host, logged-in users, running processes, and operating system details.
According to Arctic Wolf Threat Intelligence’s report on GitHub, the PaperCut process pc-app.exe has been observed launching cmd.exe and PowerShell, unusual behavior for print-management software.
Additionally, attackers have utilized the command to search for sensitive information in PaperCut configuration files:
findstr /s /i /n /c: "password"/c: "secret"/c: "bind"/c: "ldap"/c: "token"This points to an interest in extracting LDAP bind credentials, API tokens, service passwords, and other crucial authentication data stored in these files.
Credential theft is a significant aspect of this campaign, with the deployment of tools like lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe.
Delivered via certutil a legitimate Windows utility often misused for retrieving remote files, these tools enable attackers to extract registry data essential for decrypting protected registry secrets and targeting the Security Account Manager database.
Researchers noted incoming requests for files that matched certain patterns, indicating attempts to retrieve command output or other collected data.
Furthermore, the use of Meterpreter Java payloads suggests that attackers might be leveraging Metasploit tools for remote access and ongoing exploitation.
There have been reported attempts to establish a privileged account named Administrator17 within compromised environments. This development poses a significant risk, as it can grant attackers sustained access, even after patching the original vulnerabilities.
Organizations are urged to verify account management logs for unexpected administrator accounts created shortly after any suspicious activity involving PaperCut servers. Given that PaperCut has been a recurring target for cyberattacks, organizations are prompted to act swiftly.
Earlier vulnerabilities, such as CVE-2023-27350 and CVE-2023-27351, were already linked to LockBit ransomware operations, emphasizing the immediate need for patching and threat hunting.
For effective detection and response, defenders should scrutinize PaperCut server log files for exploitation-related entries, including specific error messages.
Additionally, monitoring for the creation of short, five-character files or for unusual command interpreter activations associated with pc-app.exe is advisable.
Indicators of Compromise
| IOC Type | Important Indicators |
|---|---|
| IP Addresses | 45[.]142[.]193[.]13245[.]142[.]193[.]196194[.]180[.]48[.]134 |
| Malicious Files | lsa_collect.exelsa_collect_small.exesave_hives.exe |
| SHA-256 | c3f7109963b9599eb93fd9a97a4ffa38e672642b35b33608d69e6bbf9f19da4e14779d0d7ad6be3d7bf9ed78e4ab6016f22dfa7bc8b5d9c43b56011f7fe2ea19 |
| Account | Administrator17 |
| File Patterns | /custom/pcp_[0-9a-z]{10}.txt/custom/web/pcp_[0-9a-z]{10}.txt |
| Commands | cmd.exe /d /s /c "ver || uname -a"cmd /c "whoami & ver & tasklist" |
| PaperCut Logs | jdbc:derby:memory:pwn;create=trueVALUES CAST(X'cafebabe |
| Key Behavior | pc-app.exe launching cmd.exe, PowerShell, Java payloads, or scripting interpreters |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Organizations should take proactive measures, including blocking malicious IP addresses, isolating compromised servers, rotating exposed credentials, investigating changes in administrator accounts, and applying the necessary patches as recommended by PaperCut without delay.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post Hackers Actively Exploiting PaperCut Servers Command Execution Vulnerabilities appeared first on Cyber Security News.