Affected Systems

PaperCut NG/MF all versions prior to 26.0.5, 25.0.13, and 24.1.10. Vulnerabilities CVE-2026-81578 and CVE-2026-82078 enable authentication bypass and arbitrary code execution. At least 395 organizations in 48 countries compromised, primarily U.S. education sector.

Exploitation Status

Active exploitation confirmed. Suspected Russian-speaking threat actor has weaponized both flaws to breach 395+ organizations across 48 countries using AI-powered attack infrastructure. Attacks originate from IP 45.142.193[.]132 and specifically avoid Russia, China, Hong Kong, Thailand, Iran, and 23 other countries.

Business Impact

Authentication bypass and remote code execution allow full compromise of PaperCut servers. Education sector heavily targeted. Threat actor using hundreds of AI agents (OpenAI Codex, DeepSeek) for automated mass exploitation. Unclear if access is being sold to affiliates or will lead to ransomware/data theft. Organizations running emergency patches remain vulnerable to regressions and lack full security hardening.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade PaperCut NG/MF immediately to version 26.0.5, 25.0.13, or 24.1.10 depending on your major version branch
  • If running emergency patch releases 1, 2, or 3, replace with the new maintenance releases which include additional hardening and regression fixes
  • Block inbound traffic from IP address 45.142.193[.]132 at perimeter firewalls and review logs for connections from this source
  • Audit PaperCut server logs for unauthorized authentication attempts or code execution indicators between initial emergency patch date and present
  • Assume breach if patches not applied within 48 hours of emergency release; conduct forensic review for credential theft, lateral movement, and persistence mechanisms