Education Institutions Targeted as Hackers Exploit New PaperCut Vulnerabilities to Harvest Credentials

Threat actors have begun exploiting two recently disclosed PaperCut software vulnerabilities to harvest login credentials from schools and universities across the United States and Europe, according to a report from the Arctic Wolf Adversary Research Team.

PaperCut is a print‑management platform that many educational institutions deploy to control access to printers, track usage and enforce printing policies. Because it often integrates with directory services such as Active Directory, compromising the application can give an attacker a foothold on broader campus networks.

The two flaws, identified as CVE‑2026‑81578 and CVE‑2026‑82078, allow unauthenticated actors to bypass normal authentication checks and execute code on the server hosting the print service. Exploitation of these weaknesses enables the theft of stored credentials that can be reused to access other systems.

Arctic Wolf researchers say they have observed coordinated campaigns that target the education sector, using the vulnerabilities to obtain administrative usernames and passwords. In many cases the stolen credentials are later employed to move laterally within institutional networks, potentially exposing student records, financial information and other sensitive data.

Schools and universities often operate with constrained IT budgets and may delay applying security updates, making them attractive prey for threat groups that specialize in credential‑focused attacks. The consequences of a breach can range from data exposure to the deployment of ransomware that disrupts campus operations.

The vendor has issued patches for both CVE‑2026‑81578 and CVE‑2026‑82078, and security experts are urging administrators to apply the updates without delay, enable multi‑factor authentication for privileged accounts, and monitor network traffic for abnormal access patterns.

Analysts expect the exploitation of these PaperCut flaws to continue until the majority of affected institutions have fully remediated the issue. Ongoing vigilance, regular software inventory checks and rapid patch management are being recommended as essential steps to protect the education sector from further credential‑theft campaigns.