INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

CISA Adds PaperCut NG/MF Flaws to Known Exploited Vulnerabilities Catalog

| 2026-09-01 07:48 CRITICAL HIGH EXPLOITED VULNERABILITY
JSON
Executive Summary
AI-generated
CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog Pierluigi Paganini September 01, 2026 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-82078, CVE-2026-81578 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables 5 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 5 IoCs Create Free Account
domains 3 files 2
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-82078CVE-2026-82078 CVE-2026-81578CVE-2026-81578 CVE-2023-2533CVE-2023-2533
Target & Sectors
Global Scope educationeducation healthhealth governmentgovernment
Incident Timeline
‎April 2023
Threat actors, including Muddywater and APT35 Iranian state-backed hacking groups, used chained vulnerabilities in the recently patched PaperCut zero-days to target victims linked to LockBit and Clop ransomware gangs.
tactic Ransomware
A critical remote code execution vulnerability (CVE–2023–27350) and a high-severity information disclosure flaw (CVE–2023–27351) were chained in April 2023 attacks linked to the LockBit and Clop ransomware gangs .
tactic Remote Code Execution
A critical remote code execution vulnerability (CVE–2023–27350) and a high-severity information disclosure flaw (CVE–2023–27351) were chained in April 2023 attacks linked to the LockBit and Clop ransomware gangs .
organisation LockBit
A critical remote code execution vulnerability (CVE–2023–27350) and a high-severity information disclosure flaw (CVE–2023–27351) were chained in April 2023 attacks linked to the LockBit and Clop ransomware gangs .
organisation Microsoft
Microsoft revealed two weeks later that the Muddywater and APT35 Iranian state-backed hacking groups had also joined the attacks .
‎May 2023
The Bl00dy Ransomware gang exploited the CVE–2023–27350 flaw in PaperCut to gain initial access to targets' networks.
tactic Ransomware
One month later, in May 2023, the FBI and CISA warned that the Bl00dy Ransomware gang had also begun exploiting the CVE–2023–27350 flaw for initial access to targets' networks.
attribution FBI
One month later, in May 2023, the FBI and CISA warned that the Bl00dy Ransomware gang had also begun exploiting the CVE–2023–27350 flaw for initial access to targets' networks.
‎July 2025
Threat actors exploited a recently patched remote code execution vulnerability (CVE-2023-2533) in PaperCut, which was actively targeted by the Cybersecurity and Infrastructure Security Agency (CISA).
tactic Remote Code Execution
The Cybersecurity and Infrastructure Security Agency (CISA) flagged another remote code execution vulnerability (CVE-2023-2533) as actively exploited in July 2025.
attribution CVE-2023-2533
The Cybersecurity and Infrastructure Security Agency (CISA) flagged another remote code execution vulnerability (CVE-2023-2533) as actively exploited in July 2025.
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
‎2026/08/25
Threat actors exploited recently patched zero-day vulnerabilities in PaperCut NG and MF print management software on August 25, 2026.
organisation PaperCut NG
Two security vulnerabilities in the PaperCut NG and MF print management software, patched last week after being exploited as zero-days, are now being abused in data theft attacks.
organisation MF
Two security vulnerabilities in the PaperCut NG and MF print management software, patched last week after being exploited as zero-days, are now being abused in data theft attacks.
‎Aug 29th
Threat actors used the recently patched PaperCut zero-days, CVE-2026-81578 and CVE-2026-82078 in their exploit activity.
vulnerability CVE-2026-81578
"We are observing CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF) exploit activity in our honeypots since late yesterday UTC (Aug 29th)," Defused said .
vulnerability CVE-2026-82078
"We are observing CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF) exploit activity in our honeypots since late yesterday UTC (Aug 29th)," Defused said .
organisation PaperCut NG/MF
"We are observing CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF) exploit activity in our honeypots since late yesterday UTC (Aug 29th)," Defused said .
organisation UTC
"We are observing CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF) exploit activity in our honeypots since late yesterday UTC (Aug 29th)," Defused said .
‎2026/08/31
Threat actors used the recently patched PaperCut zero-days, specifically CVE-2026-81578 and CVE-2026-82078 in the PaperCut NG/MF software, to target an organization.
vulnerability CVE-2026-81578
"We are observing CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF) exploit activity in our honeypots since late yesterday UTC (Aug 29th)," Defused said .
vulnerability CVE-2026-82078
"We are observing CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF) exploit activity in our honeypots since late yesterday UTC (Aug 29th)," Defused said .
organisation PaperCut NG/MF
"We are observing CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF) exploit activity in our honeypots since late yesterday UTC (Aug 29th)," Defused said .
organisation UTC
"We are observing CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF) exploit activity in our honeypots since late yesterday UTC (Aug 29th)," Defused said .
‎2026/09/01
Threat actors are abusing two recently patched PaperCut zero-days, CVE-2026-81578 and CVE-2026-82078, to steal data from victims' servers via Derby.
infrastructure 9.4
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability  CVE-2026-82078  (CVSS score of 9.4) PaperCut NG/MF Unsafe Reflection Vulnerability  PaperCut, the print management software running in schools, hospitals, and offices…
victims 100 users
According to PaperCut Software, the software is used by 100 million users across more than 70,000 organizations, including large companies, state agencies, and educational institutions.
victims 70,000 organizations
According to PaperCut Software, the software is used by 100 million users across more than 70,000 organizations, including large companies, state agencies, and educational institutions.
organisation PaperCut
"An actor is abusing the auth bypass to hijack PaperCut's external user-lookup.
organisation RCE
Unlike the RCE path in public writeups, the actor goes for data theft - dumping DB tables via Derby.
organisation Derby
Unlike the RCE path in public writeups, the actor goes for data theft - dumping DB tables via Derby.
organisation NG
" Internet security watchdog Shadowserver currently tracks over 800 PaperCut MF and NG servers exposed online , although there is no information on how many are honeypots or have already been secured against these attacks.
infrastructure Windows
One incident lasted under two minutes total, with the attacker running nothing more aggressive than  whoami  and  ver , basic commands to identify the compromised account and Windows version.
The attack caused PaperCut’s  pc-app.exe  Application Server to launch  charmap.exe  with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level.
infrastructure 2,500 PaperCut installations
Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions.
Tactical Metrics
Metrics
victims
100,000,000
Users
According to PaperCut Software, the software is used by 100 million users across more than 70,000 organizations, including large companies, state agencies, and educational institutions.
Metrics
victims
70,000
Organizations
According to PaperCut Software, the software is used by 100 million users across more than 70,000 organizations, including large companies, state agencies, and educational institutions.
Metrics
infrastructure
‎9.4
Software Version
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability  CVE-2026-82078  (CVSS score of 9.4) PaperCut NG/MF Unsafe Reflection Vulnerability  PaperCut, the print management software running in schools, hospitals, and offices…
Metrics
infrastructure
‎Windows
Affected Product
One incident lasted under two minutes total, with the attacker running nothing more aggressive than  whoami  and  ver , basic commands to identify the compromised account and Windows version.
The attack caused PaperCut’s  pc-app.exe  Application Server to launch  charmap.exe  with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level.
Metrics
infrastructure
2,500
Papercut Installations
Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions.
Intelligence Sources
Security Affairs 2026-09-01
BleepingComputer 2026-09-01