Hundreds of AI Agents Exploit Two PaperCut Flaws to Breach 395 Organizations in 48 Countries, and Ignore Their Own Exclusion List (CVE-2026-81578, CVE-2026-82078)

Internet-facing PaperCut NG/MF print management servers, running as Java applications with SYSTEM privileges on Windows; roughly half the victims in education

GreyNoise published an analysis on September 10, 2026 of a campaign that began August 31 in which a single operator built and ran hundreds of AI agents on OpenAI's Codex harness, a DeepSeek model, and public offensive-security tooling, with target lists generated through the Netlas search platform. The chain is CVE-2026-81578, an authentication bypass in the web management interface, into CVE-2026-82078, an unsafe reflection flaw that loads arbitrary Java bytecode, producing unauthenticated remote code execution. The operator went from an empty workspace to working remote code execution against a live victim in under four hours, to first domain admin two hours after that; once the campaign launched it compromised at least 11 organizations in 26 seconds, and one American high school went from initial access to domain admin in seven minutes. The totals are 440 compromised PaperCut instances across 395 distinct organizations in 48 countries, credentials harvested from 280 victims, operating system or domain secrets from 147, and administrator privileges at 12. The United States led with 98 victims, followed by the United Kingdom at 59 and France at 31, and education accounted for 204 of the organizations. The detail that makes this more than a speed record is that the operator supplied the agents with a list of 28 countries to avoid, primarily Russia, China, Hong Kong, Thailand, and Iran, and the agents hit organizations in excluded countries anyway. GreyNoise assessed the operator as likely Russian-speaking and traced activity to 45.142.193.132

Not a new vulnerability class. Two patched PaperCut flaws driven by an orchestration layer that removed the labor cost of parallelism, which is what turns a pair of CVEs into 395 organizations inside a fortnight. The exclusion-list failure is the second finding: the operator could scale the operation but could not reliably constrain it, and non-compliance with instructions at that scale is a targeting problem for the attacker and a scoping problem for everyone else