CVE-2023-27351

PaperCut is software many businesses use to manage office printing. This flaw is like a side door into the building's security system that lets anyone walk in and become the building manager, without needing a key or password. Once inside, attackers can take full control of the system — and criminals are already using this exact method to plant ransomware.

This matters to you if you run PaperCut NG or PaperCut MF to manage printing in your organization. It affects any installation reachable over the network, and no login credentials are needed for an attacker to exploit it.

Attackers are already exploiting this flaw in active ransomware campaigns, and it's on the US government's official list of known-exploited vulnerabilities with a fix-by deadline of May 4, 2026. This is not a theoretical risk — treat it as an emergency and patch or isolate affected systems now.

Confirm exposure by identifying all PaperCut NG and PaperCut MF instances and checking their version numbers, particularly whether the PaperCut admin web interface (default port 9191/9192) is reachable from untrusted networks or the internet. Upgrade to PaperCut NG/MF 20.1.7 or later (or the latest patched build in your branch, per vendor advisory PO-1216/PO-1219) — this release hardens the SecurityRequestFilter class that improperly validated authentication. If immediate patching isn't possible, apply the vendor's interim mitigation of restricting access to the admin interface to a trusted allow-list of IP addresses, and disable external access to the admin console entirely where feasible. CISA's KEV catalog sets a remediation due date of 2026-05-04; given active ransomware use, treat this as the outer limit, not the target. Monitor authentication logs and admin account activity for signs of unauthorized access predating the patch, and review for any unexpected scheduled scripts, new admin accounts, or scripting engine abuse (PaperCut's 'scripting' feature has been abused post-exploitation in prior incidents).

CWE-287 (Improper Authentication) in the SecurityRequestFilter class allows unauthenticated attackers with network access (AV:N, AC:L, PR:N, UI:N) to bypass login controls entirely, resulting in high confidentiality impact (CVSS 7.5, though real-world exploit chains achieve full RCE). CISA KEV confirms active exploitation in ransomware campaigns (e.g., Bl00dy, LockBit affiliates), overriding the EPSS prediction as the authoritative exploitation signal. Exploit maturity is high: public detection templates exist and exploitation has been sustained since 2023, with ongoing research attention. No authentication or user interaction is required, and exploitation is remote via the application's web management interface.