PaperCut Security Vulnerabilities Endanger Educational Institutions

Attackers are currently exploiting newly discovered vulnerabilities in PaperCut to specifically steal credentials from educational institutions in the USA and Europe. According to the Arctic Wolf Adversary Research Team, the vulnerabilities CVE-2026-81578 and CVE-2026-82078 are being exploited to carry out a chain of authentication bypasses and remote code executions. These attacks aim to gain control over systems and collect information. The CVE-2026-81578 vulnerability allows attackers to bypass authentication, while CVE-2026-82078 enables remote code execution. This combination poses a significant threat to the IT security of educational institutions, which often have inadequate security measures in place.

The attacks frequently take the form of phishing campaigns specifically targeting staff and students. Arctic Wolf researchers have noted that the attacks have increased in recent weeks. Educational institutions that use PaperCut to manage printing services are particularly at risk. The vulnerabilities were first made public in August 2026, giving attackers the opportunity to quickly adjust their tactics. Affected institutions are urged to patch their systems immediately and install security updates.

PaperCut has already released an update intended to close the security vulnerabilities. Educational institutions should also review their security policies and provide training for staff to raise awareness of phishing attacks. The impact of these attacks can be significant, as they not only lead to data loss but also undermine the trust of students and parents in the security of the institutions. Arctic Wolf researchers warn that attackers may also attempt to find additional vulnerabilities in the systems of educational institutions. The vulnerabilities in PaperCut are not the first to be exploited in the education sector.

In the past, there have been similar incidents where attackers exploited vulnerabilities in software solutions for schools and universities. These recurring attacks highlight the need to strengthen IT security in educational institutions. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning urging educational institutions to implement the new security updates immediately. CISA emphasizes that the threat of cyberattacks in the education sector remains high and that proactive measures are necessary to protect systems. Arctic Wolf researchers have also found that attackers are capable of infiltrating networks and remaining undetected.

This often occurs through the use of legitimate credentials obtained by exploiting the vulnerabilities. The ability to operate unnoticed significantly increases the risk for the affected institutions. The vulnerabilities CVE-2026-81578 and CVE-2026-82078 are part of a larger series of vulnerabilities discovered in various software solutions in recent years. The continuous discovery of such vulnerabilities indicates that cybercrime is a dynamic and ever-evolving problem affecting all sectors. Researchers advise educational institutions to conduct regular security assessments and ensure that all software solutions are up to date.

A comprehensive security approach that considers both technical and human factors is crucial to minimizing risks. The vulnerabilities in PaperCut affect a wide range of institutions that rely on this software. The exact number of affected systems is currently unknown; however, it is estimated that several thousand institutions in the USA and Europe are potentially at risk. The vulnerabilities were disclosed on August 1, 2026, and the first attacks were documented shortly thereafter. Educational institutions are urged to act quickly to protect their systems and prevent potential data losses.