CVE-2023-27351
Published 2023-04-20 · Updated 2026-10-01 · Source zdi-disclosures@trendmicro.com
Summary
CVE-2023-27351 is a high-severity (CVSS 7.5) vulnerability in PaperCut NG/MF. CISA added it to the Known Exploited Vulnerabilities catalog on April 20, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 4, 2026. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. PaperCut has 5 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.
All 5 known-exploited PaperCut vulnerabilities →Description
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA Known-Exploited Vulnerability
Product: PaperCut — NG/MF
Name: PaperCut NG/MF Improper Authentication Vulnerability
Date added: 2026-04-20 · Due: 2026-05-04
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
- https://www.zerodayinitiative.com/advisories/ZDI-23-232/
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
- https://www.zerodayinitiative.com/advisories/ZDI-23-232/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27351