The advisory does not say what the bugs are. There is no vulnerability class in the public reporting, no statement on whether CVE-2026-82078 and CVE-2026-81578 are chained or exploited separately, and no actor named for the current campaign [3]. What is public is narrow and sufficient to act on: both flaws score above 8.8, PaperCut says it has confirmed customer incidents, and more than one security firm reports exploitation in its own telemetry [1][3][6]. The 2023 round of PaperCut exploitation had names attached, Clop and Bl00dy on the criminal side [11] and an Iranian state-backed group that Microsoft said hit critical infrastructure targets with the same bug [13]. This round has none yet. That silence is more likely a gap in visibility than evidence of who is or isn't participating.
Huntress' figure sets a floor for the campaign's size. Two impacted customers is what one vendor could confirm in its own fleet [6]; it says nothing about installations with no managed detection on the print server, which is most of them.
The patch sequence is the part that changes work on the ground. The advisory went out Thursday evening with a fix that did not sufficiently address the flaws, and a corrected patch, developed with Huntress and watchTowr, landed Friday [1][2]. That is under 24 hours between a fix and its replacement [1]. Every team that ran an emergency change on Thursday and closed the ticket is still carrying the exposure [2]. The server's build number is the only proof that a change window worked; the status field in the change record is not.
Print management aggregates in a way that makes the blast radius awkward to bound. A single PaperCut instance fronts mixed fleets, Canon, Epson, Xerox and Brother among them, across universities, corporations and government [8]. watchTowr's Jake Knott put the appeal plainly: an internet-facing pivot into the corporate environment, and a treasure trove of sensitive information where printed documents are stored and can be exfiltrated [10]. Prior PaperCut bugs, he noted, were used by ransomware gangs and opportunistic attackers for initial access [9].
One detail in the advisory tells you where the exposure concentrates. PaperCut reproduced the vulnerability using information supplied by a university customer's security team [7]. Higher education found it because higher education runs it on the edge. That is the same sector CISA singled out in 2023, when it issued PaperCut guidance specifically for K-12 schools and called the education sector particularly exposed [12].
