PaperCut Vulnerability: 440 Servers, 12 Domain Admins

The short version: An AI-orchestrated agent swarm broke into 440 PaperCut print servers belonging to 395 organizations across 48 countries. It reached domain administrator at 12 of them. That is 2.7 percent. The break-in scaled almost perfectly. The takeover did not, and the thing that stopped it was not clever or expensive.

There is a second number that matters more if you run PaperCut. The first emergency patch for this PaperCut vulnerability chain shipped on 28 August 2026 at 02:10 AEST, which is 09:10 Pacific on Thursday 27 August for a US business. Within about 48 hours, researchers at watchTowr found that fix could be bypassed, and PaperCut shipped Release 2 telling customers to install it even if they had already applied the first patch. The campaign opened on Monday 31 August. If you patched quickly on that Thursday, closed the ticket, and moved on, you spent the weekend believing you were finished while the window was still open.

What happened to the 440

The campaign is documented by GreyNoise in a report published on 10 September titled Agents Gone Wild. The attacker chained two flaws: CVE-2026-81578, an authentication bypass rated 8.8, and CVE-2026-82078, an unsafe dynamic class-loading flaw rated 9.4. CISA added both to its Known Exploited Vulnerabilities catalog on 31 August, the same day the campaign began.

The speed is the part that gets quoted. GreyNoise clocked the operator going from an empty workspace to remote code execution against a real victim in under four hours, then to first domain admin two hours later. At full tilt the swarm compromised 11 organizations in 26 seconds, and at one high school, initial access to full domain administrator took seven minutes.

Now put the outcomes in a column, because GreyNoise published these figures without multiplying them out:

• 440 instances compromised
• 280 where credentials were harvested, or 63.6 percent
• 147 where operating system or domain secrets were pulled, or 33.4 percent
• 12 where the attacker reached domain administrator, or 2.7 percent

Read it as a funnel and the shape is stark. Of the 280 organizations that lost credentials, only 12 lost the domain. That is a 4.3 percent conversion. Education absorbed the worst of it, 204 of the 395 victim organizations, and even there only 7 reached domain admin, about 3.4 percent. The United States led with 98 victims, followed by the United Kingdom, France, Spain and Canada.

Why did 428 organizations not lose the domain?

No published account explains the drop-off, so here is the case from what the attacker actually used. After getting in, the agents ran Mimikatz, SharpHound, Certipy, Rubeus, Impacket and Meterpreter payloads. Every one of those is public, conventional, and in some cases more than a decade old. The swarm did not invent a new way to move sideways through a network. It ran the standard playbook, in parallel, hundreds of times.

That is precisely why most targets held. The standard playbook is the one that ordinary defenses already recognize. A print server that cannot reach a domain controller, a PaperCut service account that is not a domain admin, and a network segment that ends at the print room all defeat Mimikatz exactly as well on the four hundredth attempt as on the first. Blackpoint’s assessment, quoted in The Hacker News, lands on the same point from the attacker’s side: the strongest AI contribution was reducing the human effort needed to research, develop, debug, classify, track and retry. Effort, not capability.

This is the honest read, and it is not comfortable in either direction. Automation multiplied the cheap, repeatable part of an intrusion until it cost almost nothing. It did not multiply the part that requires a target to be badly configured. We have written before that the protection small businesses relied on was never obscurity, it was the price of an attacker’s time. This campaign is that thesis with receipts, and the other half is worth saying plainly: the controls that held were designed and maintained by people, and they absorbed a volume of attack no human team could have handled by hand.

Did patching the PaperCut vulnerability on time protect you?

Partly, and the calendar is worth walking through, because PaperCut is an Australian company publishing in AEST and that is not your clock.

PaperCut posted its urgent advisory on 27 August. The first emergency patch for versions 25 and 26 followed at 02:10 AEST on 28 August, with version 24 later the same day. That timestamp reads as Friday to the vendor and Thursday morning to a US business. Then watchTowr reproduced the vulnerabilities, found multiple patch bypasses, and turned up an additional authentication bypass, which triggered Release 2. BleepingComputer reported PaperCut urging customers to install Release 2 whether or not the first patch was already in place, alongside firewall rules restricting access to the web interface.

Meanwhile, per The Hacker News, the operator spent 31 August comparing patched and unpatched PaperCut builds. The patch was the map. That is ordinary practice in vulnerability research, and it is why a partial fix carries a risk no fix does not: it shows the other side exactly where to look.

The full security maintenance release that replaces every emergency patch landed on 10 September at 2:00pm AEST. For a business in California that was 9:00pm on Wednesday 9 September. If your last PaperCut action was an emergency patch in August, you are two releases behind.

What should a small business do this week?

Four things, in order, and none of them requires a security budget.

First, check your PaperCut version against the 10 September maintenance release and upgrade to that, not to an emergency patch. Second, confirm your PaperCut web interface is not reachable from the open internet; the 440 were found because they were. Third, look at what account the PaperCut service runs as. If it is a domain administrator, that single line is the difference between being one of the 428 and one of the 12. Fourth, assume credentials on that server were read and rotate them, because 63.6 percent of compromised instances lost credentials before anything else happened.

For the wider version, our AI cybersecurity playbook for small business owners covers what the tools watch for and what they cost. And if you run agents yourself, the lesson about what an autonomous system optimises for is the one we drew from 18,000 unwanted posts on a dormant wiki.

Frequently Asked Questions

Do I need to care about this if my business does not use PaperCut?

Not for these two CVEs, but the pattern generalises immediately. PaperCut was chosen because it is widely deployed, often internet-facing, and frequently runs with more privilege than it needs, which describes a great deal of small-business back-office software. The lesson is not about print management; it is that the account your line-of-business application runs as determines how far any intrusion travels.

I installed the emergency patch in August. Am I safe?

Not necessarily, and PaperCut said so directly. The first emergency patch was found to be bypassable within roughly 48 hours, which is why PaperCut released Release 2 and told customers to install it even if the original patch was already applied. A full security maintenance release replacing all emergency patches shipped on 10 September 2026, and that is the version to be on.

Does this mean AI has made attacks impossible to stop?

The evidence here says close to the opposite, which is the genuinely useful finding. The swarm achieved a 2.7 percent rate of full domain compromise using entirely public, conventional tooling, because AI lowered the cost of attempting an intrusion without changing what happens when an attempt meets a correctly configured network. Speed and volume went up enormously; the success rate against well-segmented targets did not.

What single check is worth the most this week?

Confirm the service account your PaperCut server runs under is not a domain administrator. Of 440 compromised instances, 280 gave up credentials but only 12 gave up the domain, and privilege boundaries are the most plausible explanation for that gap. It is a five-minute check that costs nothing.

One question we keep turning over: if a swarm of agents can now run the standard intrusion playbook hundreds of times for almost nothing, does the old advice to fix the critical vulnerabilities first still hold, or does boring privilege hygiene quietly become the higher-value work? We would like to hear from anyone who has already had to make that call.