Who Is Still Trusting Their Print Server?

# Who Is Still Trusting Their Print Server? Print servers are basically the forgotten closets of any enterprise. They just sit there in some quiet corner of the network, getting completely ignored by everyone who isn't currently fighting with a jammed tray or hunting for a missing toner cartridge; we end up treating them like plumbing. As long as the documents actually come out of the machine and the logs don't start screaming at us, we assume they're inert. They aren't. PaperCut NG/MF is everywhere in schools and universities. It basically runs the show on who gets to print and what they pay. This week, though, that logic got thrown out the window. Two vulnerabilities, CVE-2026-81578 and CVE-2026-82078, moved from theoretical research to active attacks. CISA added them both to the KEV on August 31. Federal agencies have until September 14 to deal with it. The technical side is pretty straightforward, and there's an unauthenticated path straight to admin credentials. CVE-2026-81578 is called "Missing Authentication for Critical Function," which is just a fancy way of saying they forgot to lock the front door. Pair that with the unsafe reflection flaw in CVE-2026-82078 and you've got a perfect setup for stealing credentials. Everything before version 24.1.2 is at risk. The fix arrived in an update released this month. If you're still on any v23 build or early v24, you're basically hosting a public list of your admin passwords. Why the gap between the vendor advisory and the researcher write-ups? The advisory claims specific function calls failed. Researchers think there is a systemic failure in how the management API handles session state. I trust the researchers on this. When authentication goes missing on a critical function, it's rarely some fluke, and it usually means the authorization middleware was bypassed for that endpoint entirely. Some will argue that print servers are isolated in their own VLANs and don't pose a systemic risk to the rest of the network. That is a comfortable lie. University print servers don't sit alone in the dark. They connect to Active Directory or LDAP (the usual suspects for identity) to check who is a student and who is faculty. If someone uses CVE-2026-81578 to dump credentials from the PaperCut database, they get more than just printer access. They walk away with valid credentials, often high-privileged ones, which they can use to jump into payroll databases or the Student Information System. The bigger risk actually lies with the Managed Service Providers, and smaller districts often don't have a full-time admin for their printers, so they outsource the PaperCut management to third-party contractors. If an MSP uses shared credentials or a central console for all their clients, one compromised printer in some rural high school becomes a doorway into 20 different districts at once, and the contractor is just the delivery vehicle. I'm sick of seeing the word "critical" on every single vendor advisory. Most of the time it's just PR to sell more support contracts. This time they earned it though. Any flaw that lets unauthenticated remote attackers steal credentials from a campus or internet-facing server is critical by definition. You can't find a "mitigating control" that makes a missing authentication check okay. We've seen this before. It sounds like PrintNightmare or those old spooler flaws from a while back. The common thread is how people just ignore print infrastructure. But the target here is different, and attackers are hitting schools because the ratio of users to admins is ridiculous and patching happens on an academic calendar instead of based on security. If you're an admin, don't trust your dashboard just because it looks green. Look at the version number, and if you aren't on 24.1.2 or higher, you're basically offering a free service to anyone who knows how HTTP requests work. It takes just under two weeks for the federal deadline to hit on September 14. For everyone else, the attackers didn't wait for a CISA memo to start scanning. How many secure campuses ignore their print servers? They treat them as low priority assets while an attacker uses them to map out the subnet; it's a specific kind of blindness. Just because a device doesn't store credit card numbers doesn't mean it can't be used to steal the keys to the kingdom. I'll watch the KEV for signs that this is moving into ransomware. Credential theft in academia is usually just the preamble to a lock-up and a six figure demand. The fix is a simple update. The hard part is finding all the servers you forgot you had.