PaperCut to Domain Admin. The access path.
Two CVEs in a print server ended at every credential in the domain. The exploit reached 440 print servers. The service account behind them decided who lost the domain.
The record
Entry point. netlas-scan, exposed PaperCut servers, target list built via API.
The identity in the middle. The PaperCut service account, which held an LDAP bind plus database and machine credentials.
What was reached. ntds.dit, DCSync, every credential in the domain.
Two CVEs in a print server ended at every credential in the domain.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| netlas-scan | Entry | exposed PaperCut servers, target list built via API |
| papercut-server | Step | CVE-2026-81578 config change, no authentication |
| code-execution | Step | CVE-2026-82078, runs as the PaperCut service |
| service-account | Step | LDAP bind, database and machine credentials |
| active-directory | Step | pass-the-hash, noPac, or simply Domain Admins |
| ntds.dit | Reached | DCSync, every credential in the domain |
Where a breakpoint would have been
The service account privileges. Both CVEs still execute code with either patch missing, but a service account that cannot reach Active Directory beyond its own function does not end at DCSync. This is the clearest case in the database for scoping an identity rather than racing the patch.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
6 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
GreyNoise · Blackpoint Cyber · PaperCut security bulletin · BleepingComputer · Help Net Security
Questions, answered.
The two questions this record answers.
What was the entry point in the PaperCut to Domain Admin incident?
The published path starts at netlas-scan, exposed PaperCut servers, target list built via API.
What did it reach?
The last step in the published path is ntds.dit, DCSync, every credential in the domain.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.