Attackers Exploit Paper Cut Flaws to Steal Credentials From Schools and Universities
Summary: Threat actors are exploiting CVE-2026-81578 and CVE-2026-82078, an authentication bypass and remote code execution chain in PaperCut, to steal credentials from K-12 schools and major universities in the U.S. and Europe. Arctic Wolf reported post-exploitation activity including delivery of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, creation of privileged accounts, and reconnaissance commands, with lsa_collect.exe observed extracting registry keys to reconstruct the system BootKey and access the SAM database.
Why it matters: Stolen logins from a compromised PaperCut server give attackers a pathway into other critical systems across the environment, and the targeted range runs from K-12 schools to major universities in two regions.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-81578CVE-2026-82078
- Related