Education Institutions Targeted as New PaperCut Vulnerabilities Enable Credential Theft

Security researchers have identified that cyber attackers are leveraging two recently disclosed PaperCut software flaws, designated CVE-2026-81578 and CVE-2026-82078, to compromise networks at schools throughout the United States and Europe. The vulnerabilities allow threat actors to extract user credentials and elevate their privileges, giving them broader access to internal systems.

PaperCut, a widely used print‑management solution in K‑12 and higher‑education environments, suffered the flaws after a coordinated disclosure earlier this year. The first vulnerability (CVE-2026-81578) concerns improper authentication checks that can be bypassed by sending crafted HTTP requests, while the second (CVE-2026-82078) involves insecure handling of session tokens, enabling attackers to hijack active user sessions. Both issues are rated as critical by the vendor’s advisory.

Since the public release of the advisories, multiple incidents have been reported in which attackers first gained a foothold through phishing or compromised VPN accounts, then used the PaperCut weaknesses to harvest additional credentials stored within the print‑service database. In several cases, the stolen data included administrator passwords, allowing the perpetrators to install back‑doors, deploy ransomware, or exfiltrate student records.

Education authorities are particularly vulnerable because many schools rely on legacy IT infrastructure and often lack dedicated security staff. The attacks have been observed across a mix of public and private institutions, ranging from small district schools in the Midwest to large university campuses in the United Kingdom. While no large‑scale data breach has been publicly confirmed, the pattern suggests a coordinated campaign aimed at exploiting a common, trusted service.

In response, PaperCut has issued patches for both CVEs and recommends immediate deployment. The vendor also advises administrators to enforce multi‑factor authentication, restrict access to the management console, and monitor for unusual API calls. Cyber‑security agencies in the U.S. and EU have issued alerts urging schools to audit their print‑management configurations and apply the updates without delay.

Experts warn that the exploitation of these flaws underscores a broader challenge: the reliance on third‑party software that may become a gateway for attackers if not rigorously maintained. As educational institutions continue to digitize operations, the need for regular patch management, network segmentation, and user education becomes increasingly critical to prevent similar incidents.

Looking ahead, investigators are tracking the threat actors behind the campaign, but attribution remains uncertain. Authorities hope that swift remediation and heightened awareness will limit further intrusion attempts, while schools are urged to review overall cybersecurity posture to safeguard sensitive student and staff information.