CVE-2023-2533: PaperCut NG/MF CSRF allows admin security setting changes and code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a near-term remediation deadline, has a high CVSS of 8.8, and public exploit material is referenced, so it is being actively targeted.

What it is

PaperCut NG and MF contain a cross-site request forgery flaw that, under specific conditions, lets an attacker change security settings or execute arbitrary code. It matters because the target is an authenticated admin session, so a single crafted link can turn a trusted administrator into the execution path for high-impact changes.

Impact

An attacker can alter security settings or execute arbitrary code in the context of a logged-in PaperCut administrator, gaining control over the application's configuration and potentially the host.

Attack surface

Reached over the network via a crafted link that an administrator must click while holding a valid session; no prior authentication is needed by the attacker, but user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:R).

Exploitation

CISA added this to KEV on 2025-07-28 with a remediation due date of 2025-08-18, and EPSS shows a 30-day probability of 0.29246 (98th percentile); a third-party advisory is tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor fix from the PaperCut June 2023 security bulletin immediately; treat this as the primary action given KEV listing.
• If patching cannot be completed by the CISA due date, follow the vendor's interim mitigations or discontinue use of the affected product per BOD 22-01 guidance.
• Restrict administrative access to PaperCut NG/MF interfaces to trusted networks and require administrators to log out when not actively managing the system.
• Enforce same-site cookie attributes and CSRF protections at any reverse proxy in front of PaperCut where supported.
• Audit admin accounts and sessions for unexpected changes to security settings after exposure.

Detection

• Review PaperCut admin audit logs for unexpected changes to security settings or configuration outside normal change windows.
• Hunt web and proxy logs for requests to PaperCut admin endpoints with suspicious Referer or Origin headers, or missing/foreign referrers.
• Monitor for new or modified processes spawned by the PaperCut application service that are inconsistent with normal print management activity.
• Correlate admin session activity with external link clicks or unusual inbound requests around the time of configuration changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.