Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe. The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 – an authentication bypass and remote code execution chain – to conduct command execution and reconnaissance, as well as

The article reports that threat actors are exploiting newly disclosed PaperCut vulnerabilities, CVE-2026-81578 and CVE-2026-82078, to bypass authentication and achieve remote code execution, enabling command execution, reconnaissance, and credential theft against schools and universities in the U.S. and Europe. These are traditional software supply chain and infrastructure risks, not AI-specific flaws. From a RealGround perspective, any AI agents or workflows integrated with PaperCut or running on compromised infrastructure could have their credentials, access tokens, or data pipelines abused, creating an indirect AI supply chain exposure. Organizations should treat dependencies like PaperCut as part of their AI supply chain, maintain SBOMs, and ensure that AI-related services and agents are isolated from printing and authentication systems so that exploitation of such CVEs cannot be used to pivot into AI systems.