PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws

PaperCut has released new maintenance versions (26.0.5, 25.0.13, 24.1.10) that replace emergency patches for two actively exploited vulnerabilities, CVE-2026-81578 and CVE-2026-82078, which allow authentication bypass and arbitrary code execution. A suspected Russian-speaking threat actor has exploited these flaws to compromise at least 395 organizations across 48 countries, primarily targeting the U.S. education sector. The attacks involve the use of hundreds of AI agents and originate from the IP address 45.142.193[.]132, with observed activity avoiding certain geographic regions. Customers are urged to upgrade from emergency patches to the fully tested maintenance releases for complete protection.

AI-extracted · verify before operational use