The IT Guys Security Alert with Jennifer Hudsen • September 5, 2026 • Cutoff 7:50 a.m. EDT / 11:50 UTC
PaperCut Attacks Now Show Credential-Harvesting Activity: Patch, Preserve Evidence and Review Identity Exposure
Current status: PaperCut says its urgent advisory remains active and that a second wave is targeting publicly available PaperCut NG/MF servers that are not fully patched. Arctic Wolf has now documented observed post-exploitation activity that included registry-hive collection tools, searches for password- and token-related configuration terms, Meterpreter-related Java payloads and attempts to create privileged accounts. [1] [2]
The decision in one minute
If a PaperCut NG/MF server was internet-accessible while running a vulnerable build, treat this as more than a patch-management ticket. Preserve evidence first, restrict untrusted access, move supported v24–v26 systems to PaperCut’s Emergency Patch Release 3, and perform a scoped identity and compromise assessment. Patching closes the known software entry path; it does not prove that credentials, tokens or persistence were never obtained before the update. [1] [2]
What changed since the earlier PaperCut alerts
The vulnerabilities themselves are not new today. PaperCut disclosed active exploitation on August 27, CVE records followed on August 28, and CISA added both CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalog on August 31. The new development is Arctic Wolf’s September 4 account of what it observed after exploitation. [3] [2]
Arctic Wolf reports command execution and reconnaissance followed by attempts to create privileged accounts. Its record says observed tooling collected Windows registry hives, searched PaperCut configuration files for terms associated with passwords, secrets, LDAP, bind settings and tokens, and included activity intended to enable access to the Windows Security Account Manager database. [2]
That evidence changes the practical response. An affected organization should not stop at “the PaperCut version is current.” It should ask whether secrets or identity material may have been exposed before remediation, whether unexpected accounts appeared, and whether the PaperCut service launched unusual child processes or made unexplained outbound connections. This is a defensive risk inference from the activity Arctic Wolf observed—not proof that every vulnerable server was exploited or that credentials were successfully reused. [2]
Who is exposed?
The exposure predicate has several parts: a PaperCut NG/MF build below the fixed release for its branch, a reachable management surface or another path through which the vulnerable functions can be reached, and the conditions needed to chain configuration manipulation into unsafe class loading. Presence of the product alone does not prove internet exposure, and a server being internet-accessible does not prove successful exploitation. [4] [5]
| Branch | Fixed boundary in the CVE records | Priority question |
|---|---|---|
| 24.x | 24.1.10 or later [4] [5] | Was any earlier build reachable from an untrusted network? |
| 25.x | 25.0.13 or later [4] [5] | Was Release 3 applied to the internet-facing Application Server? |
| 26.x | 26.0.5 or later [4] [5] | Were Site Servers and secondary/print servers also updated? |
PaperCut says Emergency Patch Release 3 supersedes Release 2, accumulates the earlier emergency fixes, addresses two regressions and adds hardening against additional attack chains. The vendor recommends Release 3 for internet-facing Application Servers and says Site Servers and secondary or print servers should also be on patched versions. [1]
Why the two CVEs matter together
CVE-2026-81578 is an authentication-bypass weakness in the web management interface. PaperCut’s CVE record says that, under specific conditions, unauthenticated remote requests can trigger backend actions before access validation completes, allowing modification of certain system configurations. PaperCut scores it 8.8 High under CVSS 4.0. [4]
CVE-2026-82078 is an unsafe dynamic-class-loading weakness in PaperCut’s database connection utilities. If an attacker can manipulate system configuration parameters, the record says arbitrary Java bytecode already residing on the application classpath can execute under the PaperCut server process’s security context. PaperCut scores it 9.4 Critical. [5]
CISA’s KEV entries explicitly say the vulnerabilities can be chained. CISA lists both as added August 31 with a September 14, 2026 due date for the federal remediation entry and marks known ransomware-campaign use as “Unknown.” That date is a federal catalog deadline, not a universal legal deadline for every private business, but KEV inclusion is a strong prioritization signal for everyone operating an exposed system. [3]
Safe response order
- Inventory before changing. Record the PaperCut Application Server, Site Servers and secondary/print servers; capture branch, complete build, hosting model, external exposure history and when each system last changed. Do not assume the primary server represents the whole deployment.
- Preserve evidence when exposure or suspicious behavior existed. Retain PaperCut logs, operating-system event records, process and account timelines, relevant network telemetry, configuration snapshots and backup provenance according to the organization’s incident-response policy. PaperCut cautions that absence of its listed indicators does not prove a system was unaffected. [1]
- Restrict untrusted reachability. Remove direct internet exposure from PaperCut management interfaces where practical and enforce the organization’s approved firewall, VPN or access-control design. Verify the effective path through load balancers, NAT, cloud controls and IPv6—not just a local firewall checkbox.
- Apply PaperCut’s current vendor guidance. Move supported internet-facing v24–v26 deployments to Emergency Patch Release 3 through authorized backup, testing and change control. Update the other PaperCut server roles as the vendor directs. Recheck the advisory before implementation because it remains active. [1]
- Hunt for identity-focused activity. Review unexpected privileged-account creation, suspicious PaperCut child processes, registry-hive collection artifacts, configuration-secret searches, unusual files in PaperCut paths and unexplained outbound sessions. Use Arctic Wolf’s current defensive considerations and PaperCut’s current indicators as starting points, not as an exhaustive clearance checklist. [2]
- Scope and rotate deliberately. If evidence indicates secrets may have been collected, identify affected service accounts, LDAP bind credentials, tokens and dependent systems. Rotate from a clean administrative system after evidence preservation and impact analysis, using an order that avoids destroying evidence or breaking dependencies. Patching PaperCut alone does not revoke a credential that was already copied. [1] [2]
- Verify the outcome. Confirm the active build on every server role, confirm old services or containers are gone, recheck external reachability, review new account activity and watch logs and availability after the change. A deployment console saying “successful” is not the same as proving the patched runtime is active everywhere.
Keep the evidence boundaries straight
Confirmed: PaperCut reports active exploitation and a second wave against publicly available, not-fully-patched servers. Arctic Wolf reports credential-focused post-exploitation behavior and attempted privileged-account creation in activity it observed. CISA lists both CVEs in KEV. [1] [2] [3]
Not established: the reviewed sources do not establish attacker identity, ransomware affiliation, total victim count, successful credential reuse across the campaign, compromise of every exposed server, or impact to The IT Guys or its customers. Arctic Wolf’s visibility must not be treated as universal campaign scope. [1] [2] [3]
Important: a negative IOC search is not a clean bill of health. PaperCut says its indicator list is not proof of absence, and Arctic Wolf describes its published indicators as a subset rather than an exhaustive campaign inventory. [1] [2]
Frequently asked questions
We installed an earlier emergency patch. Are we done?
No. PaperCut says Release 3 supersedes Release 2 and recommends Release 3 for internet-facing Application Servers. Confirm every server role and its active build rather than assuming the primary server update covered the deployment. [1]
Does installing Release 3 erase the need for incident response?
No—not when the system was exposed while vulnerable or evidence suggests suspicious activity. The update addresses the product risk going forward; it cannot prove what happened beforehand or revoke secrets that may already have left the server. PaperCut recommends incident-response procedures and says wipe/rebuild from a clean pre-incident backup may be appropriate when compromise is suspected. [1]
Does this prove schools or universities were compromised?
Not from the primary evidence used here. The Arctic Wolf record documents observed activity but does not name victim organizations or establish that education is the exclusive target sector. We are therefore not repeating broader victim-sector claims as confirmed facts. [2]
Should we execute public exploit code to test our server?
No. Inventory versions and exposure, review vendor and Arctic Wolf defensive evidence, and use an authorized incident-response process. Do not aim public exploit or malware tooling at production or third-party systems.
Sources
- PaperCut — Urgent Security Advisory (August 27, 2026) — active advisory, Release 3 guidance, server-role coverage and incident-response cautions.
- Arctic Wolf — Exploited PaperCut vulnerabilities lead to credential theft (September 4, 2026) — observed post-exploitation behavior and defensive considerations.
- CISA — Known Exploited Vulnerabilities Catalog JSON — both CVEs added August 31, 2026, due September 14, 2026.
- CVE Program — CVE-2026-81578 record — authentication-bypass description, affected versions and CVSS 4.0 score.
- CVE Program — CVE-2026-82078 record — unsafe dynamic-class-loading description, affected versions and CVSS 4.0 score.
Reporting cutoff: September 5, 2026, 7:50 a.m. EDT / 11:50 UTC. This is a material update to the existing PaperCut incident lineage, not a claim that a new vulnerability appeared today. Hero: ORIGINAL JENNIFER EDITORIAL CONCEPT — NOT AN INCIDENT PHOTOGRAPH, PAPERCUT LOGO OR GOVERNMENT GRAPHIC.