Print management software developer PaperCut has issued a critical advisory urging enterprise administrators to replace earlier emergency hotfixes with newly released, fully validated Maintenance Releases (MR) across all supported versions of PaperCut NG and PaperCut MF. The update comes amid escalating threat intelligence reporting that threat actors deployed swarms of automated AI agents to scan and compromise more than 440 unpatched servers worldwide.

The flaws under active weaponisation, cataloged as CVE-2026-81578 and CVE-2026-82078, permit remote attackers to bypass authentication gates and execute arbitrary system commands on underlying print management application hosts.

The Emergency Patch Whiplash

Organizations that rushed to install Emergency Patch Releases 1, 2, or 3 over the preceding fortnight encountered unexpected regressions in print-job routing and LDAP directory synchronization. Recognizing that fragmented emergency hotfixes created operational friction and left corner-case bypass vectors open, PaperCut consolidated all security protections and code refactoring into formal maintenance builds:

  • PaperCut NG / MF 26.0.5
  • PaperCut NG / MF 25.0.13
  • PaperCut NG / MF 24.1.10

PaperCut confirmed that these builds have undergone comprehensive regression testing and supersede all interim hotfix files.

AI Agent Swarms: Automated Mass Exploitation

What sets this wave of PaperCut compromises apart is the methodology employed by the threat actors. Rather than relying on static scanning tools like masscan or Shodan queries followed by manual hands-on-keyboard exploitation, security researchers observed coordinated clusters of autonomous AI agents executing end-to-end attack loops:

  1. Adaptive Fingerprinting: Autonomous agents dynamically probed web application responses to determine exact minor versions and installed hotfixes, adjusting payload formatting on the fly.
  2. Authentication Bypass & Ingestion: Exploiting CVE-2026-81578 to circumvent login challenges, the agents created unauthorized administrative service accounts.
  3. Payload Staging: The agents automatically uploaded lightweight staging loaders that surveyed the surrounding local network, enumerated Active Directory trust boundaries, and established persistent reverse shells back to bulletproof C2 relays.

More than 440 servers were compromised in under 48 hours. When offensive actors use agent swarms, defenders are no longer racing against human reaction times — they are racing against parallelised compute.

Defensive Posture & Verification Runbook

System administrators responsible for PaperCut installations must execute the following remediation steps:

  • Deploy Consolidated Maintenance Releases: Upgrade to version 26.0.5, 25.0.13, or 24.1.10. Do not rely on intermediate hotfix scripts.
  • Inspect User Accounts for Unauthorized Admins: Review the PaperCut administration panel under Options > User / Group Sync and internal user tables for newly created administrator accounts with randomized alphanumeric names.
  • Review Application Execution Logs: Check [app-path]/server/logs/server.log for abnormal HTTP POST requests targeting setup wizards or system configuration endpoints originating from external IP subnets.
  • Terminate Inbound Internet Access: Print management servers should never be directly accessible from the public internet. Block inbound port 9191 and 9192 at external firewalls; remote users should connect strictly via VPN.