AI-Powered PaperCut Exploitation Hits 395 Organizations

A PaperCut AI attack compromised at least 440 PaperCut NG/MF instances across 395 identified organizations in 48 countries. GreyNoise linked the campaign to a likely Russian-speaking threat actor using hundreds of AI agents to accelerate exploit development and deployment.

The campaign targeted CVE-2026-81578, an authentication bypass, and CVE-2026-82078, an unsafe dynamic class-loading vulnerability.

Together, the flaws created a path from unauthorized configuration changes to unsafe dynamic class loading. That chain could lead to code execution on vulnerable PaperCut servers.

PaperCut has confirmed active exploitation and released security maintenance versions 24.1.10, 25.0.13, and 26.0.5. Organizations should upgrade to an appropriate fixed release rather than relying on the earlier emergency patches.

PaperCut AI Attack at a Glance

How Two PaperCut Flaws Created a Path to Code Execution

The campaign depended on two vulnerabilities with different roles.

CVE-2026-81578 affects the PaperCut NG/MF web management interface. PaperCut describes it as an improper access-control vulnerability. Under specific conditions, unauthenticated requests targeting administrative functions can trigger backend actions before access validation completes.

As a result, a remote unauthenticated attacker can modify certain system configurations. The vulnerability carries a CVSS v4.0 score of 8.8.

CVE-2026-82078 affects PaperCut’s database connection utilities. The application could instantiate database driver classes using configurable driver names without validating them against an approved allowlist.

An attacker who could manipulate those configuration parameters could execute arbitrary Java bytecode already present on the application classpath. That code runs under the security context of the PaperCut server process. PaperCut rates this vulnerability 9.4 under CVSS v4.0.

Chaining the two weaknesses therefore connected unauthorized administrative configuration changes with code execution in the PaperCut server process.

Hundreds of AI Agents Compressed the PaperCut Attack Timeline

The distinguishing feature of this campaign was not simply that AI helped write malicious code.

GreyNoise found that the adversary built a lab containing vulnerable PaperCut software and an Active Directory server. The attacker used that environment to develop and test exploitation before targeting real systems.

Hundreds of AI agents then supported the operation at scale. GreyNoise reported that the infrastructure combined OpenAI’s Codex harness with a DeepSeek model. The attacker also used Netlas to generate target lists.

The resulting attack tempo was unusually compressed.

GreyNoise observed the adversary move from an empty workspace to remote code execution against a real victim in under four hours. Domain administrator access followed roughly two hours later.

Once the full campaign launched, at least 11 organizations were compromised within 26 seconds. In one U.S. high school environment, initial access progressed to domain administrator privileges in seven minutes.

However, domain-level escalation occurred in only a subset of compromised environments.

How PaperCut Compromise Reached Active Directory

GreyNoise documented three main routes from compromised PaperCut infrastructure toward domain-level privileges.

First, attackers dumped LSASS memory and registry secrets from domain-joined PaperCut servers. Recovered credential hashes could then support pass-the-hash activity against domain controllers.

Second, the adversary exploited noPac in environments that remained vulnerable to CVE-2021-42278 and CVE-2021-42287. Those older Active Directory vulnerabilities created another privilege-escalation route.

Third, some environments exposed an even shorter path. Where PaperCut ran on a domain controller or under a domain administrator service account, the attacker could add a newly created account to the Domain Admins group.

GreyNoise reported that after successfully reaching domain administrator privileges, the attacker used DCSync to replicate Active Directory credential data from domain controllers.

The findings demonstrate why PaperCut’s deployment context matters. Compromise of the application can become considerably more serious when its server holds privileged credentials or operates with excessive domain permissions.

How the PaperCut AI Attack Progressed Beyond Initial Access

The compromise extended well beyond initial server access. Credential harvesting occurred on 280 victims, while researchers observed operating system or domain secrets obtained from 147.

However, organizations should distinguish those figures from full domain compromise. GreyNoise observed domain administrator access at 12 organizations.

The campaign’s final objective also remains unclear. GreyNoise said it could not determine whether the actor planned to retain or transfer access, steal data, deploy ransomware, or pursue another objective.

Therefore, the confirmed incident should not be described as a ransomware campaign or confirmed data-theft operation.

PaperCut Recommends Moving to Security Maintenance Releases

PaperCut initially issued emergency patches as it investigated active exploitation. The vendor has since released full security maintenance versions that replace those emergency fixes.

Organizations should upgrade to:

• PaperCut NG/MF 24.1.10
• PaperCut NG/MF 25.0.13
• PaperCut NG/MF 26.0.5

Administrators should also investigate PaperCut systems that were exposed while vulnerable.

Because attackers targeted credentials and Active Directory after initial compromise, incident response should extend beyond installing the update. Teams should review the affected server’s security context, investigate suspicious credential access, and assess whether privileged accounts were exposed.

Organizations should also avoid running PaperCut with unnecessary domain privileges. A compromised application should not automatically inherit authority that creates a direct route to domain administration.

Where Hexnode Fits into PaperCut Incident Response

PaperCut itself must be upgraded through PaperCut’s supported server-update process. Hexnode UEM and Hexnode XDR support the surrounding endpoint management and incident-response layers rather than replacing that remediation.

Use Hexnode UEM to Maintain Endpoint Patch Posture

The campaign showed how unpatched weaknesses elsewhere in an environment can extend an initial application compromise.

Hexnode UEM provides patch-management workflows for supported Windows and macOS devices. Administrators can identify missing updates, manage patch deployment, automate supported patch workflows, and review patch compliance.

Hexnode UEM also supports custom script execution on managed Windows, macOS, and Linux devices. On managed Windows systems, administrators can use custom scripts for version checks and other administrative tasks.

Where the PaperCut installer and deployment requirements are compatible, admins can also configure unattended deployment of the applicable PaperCut maintenance release.

PaperCut supports command-line options for automated Windows installation, while Hexnode UEM supports Windows EXE deployment and custom installation parameters.

However, PaperCut’s security maintenance release remains a PaperCut-specific remediation task unless its update is explicitly supported through an organization’s applicable Hexnode patch workflow.

Investigate Suspicious Endpoint Activity with Hexnode XDR

GreyNoise observed the attacker move from an empty workspace to remote code execution against a real victim in under four hours. That compressed timeline makes historical endpoint context valuable during retrospective investigation.

Hexnode XDR‘s Advanced Investigation Query provides access to seven days of detailed endpoint data. Analysts can query historical endpoint activity to investigate events surrounding suspected initial access and subsequent activity. MITRE ATT&CK Insights also maps detected threats to ATT&CK techniques, adding technique-level context during investigation.

If malicious endpoint activity is identified, documented response actions include device isolation, process termination, and file quarantine.

These controls can support investigation and containment after suspicious activity reaches supported endpoints. They do not replace upgrading PaperCut, investigating Active Directory, rotating compromised credentials, or performing domain-level incident response.

Featured resource

Why XDR Is Stronger With UEM

See how combining UEM context with XDR investigation and response can help IT and security teams strengthen endpoint protection and accelerate incident containment.

Download the whitepaper

What Enterprises Should Do After the PaperCut AI Attack

Organizations running PaperCut NG/MF should prioritize several actions:

1. Upgrade PaperCut immediately to the applicable security maintenance release or a later secure version.
2. Identify previously exposed systems. Use available inventory records and, where appropriate, Hexnode UEM custom scripts to collect relevant system or application information from managed endpoints.
3. Investigate credential access on affected PaperCut servers and assess whether privileged credentials or Active Directory secrets were exposed.
4. Review PaperCut service-account privileges and remove unnecessary domain-level permissions.
5. Check Active Directory patch posture, particularly where older vulnerabilities could create additional escalation routes.
6. Investigate suspicious endpoint activity. On supported endpoints monitored by Hexnode XDR, use query-based investigation to review relevant historical activity. If malicious activity is confirmed, use documented containment actions such as device isolation where appropriate.
7. Rotate credentials where investigation identifies exposure and follow established incident-response procedures.

The central lesson from this campaign is its speed. AI agents allowed one operator to move from exploit development to widespread exploitation on a compressed timeline.

Yet the post-exploitation routes remained recognizable: credential dumping, pass-the-hash, unpatched Active Directory vulnerabilities, excessive service-account privileges, and DCSync.

That makes the defensive priorities equally familiar. Patch exposed software quickly, reduce privileged access, investigate credential exposure, and maintain endpoint visibility before a server foothold becomes a domain-wide incident.