Credential Theft in Schools via PaperCut Flaws

Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe. The Arctic Wolf Adversary Research Team observed attackers exploiting CVE‑2026‑81578 and CVE‑2026‑82078 – an authentication bypass and remote code execution chain – to conduct command execution and reconnaissance, as well as other malicious activity. ¹

CVE‑2026‑81578 allows attackers authenticating against any version prior to v9.3 by sending “admin” with specifically crafted HTTP header parameters that require only basic network connectivity. Tools freely available through GitHub repositories enable this attack against organizations relying on outdated software versions often lacking automated patch management processes.

Education institutions frequently face budget constraints and IT staff shortages, causing delayed patching similar to past WannaCry outbreaks that crippled UK NHS hospitals in May 2017. These conditions make K–12 districts prime targets for APT actors prioritizing high-value data such as student records rather than mass disruption.