Hackers Exploit PaperCut Bugs to Steal Logins From Schools and Universities

Key points

• Attackers are actively exploiting two new flaws in PaperCut, the print management software used across thousands of schools, to steal login credentials.
• The chain combines CVE-2026-81578, an authentication bypass, with CVE-2026-82078, a remote code execution flaw.
• Arctic Wolf's Adversary Research Team says victims so far are concentrated in the education sector in the United States and Europe.
• Attackers are running commands on servers, probing internal networks, and lifting credentials for later use.
• Schools running PaperCut should patch immediately and treat any exposed server as potentially breached.

Schools and universities are being broken into through their print servers.

Researchers at Arctic Wolf say attackers are exploiting two freshly disclosed bugs in PaperCut, a widely used piece of software that manages printing on school and office networks, to steal credentials from education institutions across the United States and Europe. The Hacker News first reported the attack.

What are the flaws?

Two vulnerabilities are being chained to take control of PaperCut servers.

CVE-2026-81578 is an authentication bypass: it lets an attacker skip the login screen entirely and act as an administrator. We first covered both CVEs on 5 September 2026, and PaperCut's emergency patch response goes back to late August.

CVE-2026-82078 is a remote code execution bug. Once past the login, an attacker can make the server run any command they choose.

Used together, the two turn an internet-facing print server into a foothold inside the school's network.

What are the attackers doing once they get in?

Once inside, intruders are running commands on the server, mapping the wider network, and stealing credentials they can reuse elsewhere.

Arctic Wolf describes the activity as reconnaissance followed by credential theft, the classic early stages of a bigger intrusion. A PaperCut server rarely holds sensitive data itself, but it typically sits on the same internal network as payroll, student records, and the finance team's shared drive. Passwords lifted there often work elsewhere, because staff tend to reuse the same login across systems.

Why target schools?

Education networks tend to run older software, carry small IT teams, and expose services to the public internet so staff and students can print from home. PaperCut fits that profile. Ransomware crews exploited a different set of PaperCut flaws in 2023, with groups including Cl0p and LockBit among those observed at the time.

US schools fall under a patchwork of state breach-notification laws and, where student data is involved, the Family Educational Rights and Privacy Act. In the UK and EU, data protection authorities have jurisdiction under the UK GDPR and GDPR respectively.

Should you worry?

If your organisation runs PaperCut, it's worth treating this as urgent. Patch to the latest version today and check whether the admin interface has been reachable from the public internet. Any exposed server should be assumed already touched.

Staff and students at affected institutions should watch for password reset emails they didn't request and for phishing messages referencing real internal systems. Change any password shared between a school account and a personal one. Turn on multi-factor authentication where the option exists.

IT teams should hunt for unexpected commands run by the PaperCut service account, new local users, and outbound connections from the print server to unfamiliar addresses.

The pattern here is depressingly familiar: a widely deployed product, an under-resourced sector, and attackers who clearly know both. Watch whether credential theft escalates to ransomware deployment, because that's exactly what happened in 2023.