CyberSecurity News
Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
AI summary
Threat actors are taking advantage of recently disclosed vulnerabilities in PaperCut to steal credentials from schools and universities in the US and Europe. The vulnerabilities, which include an authentication bypass and remote code execution, are being exploited to execute commands and gather information. The attacks have been observed by the Arctic Wolf Adversary Research Team, which identified the specific flaws being exploited as CVE-2026-81578 and CVE-2026-82078. These flaws allow attackers to bypass authentication and execute code remotely, facilitating their credential theft efforts. The education sector is the primary target of these attacks.
Vulnerabilities mentioned
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.