CVE-2023-27351: PaperCut NG/MF authentication bypass in SecurityRequestFilter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote authentication bypass in an internet-facing product that is in CISA KEV with known ransomware use and very high EPSS probability.

What it is

PaperCut NG and MF contain an improper authentication flaw in the SecurityRequestFilter class caused by a faulty authentication algorithm implementation. A remote, unauthenticated attacker can bypass authentication on affected installations, and the flaw is listed in CISA KEV with known ransomware campaign use, making it a serious exposure for internet-facing print management servers.

Impact

An attacker gains unauthenticated access to the PaperCut system, bypassing the login control entirely; the CVSS vector indicates high confidentiality impact, so sensitive data on the server can be read.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N and the description. Any PaperCut NG/MF instance exposed to untrusted networks is in scope.

Exploitation

Listed in CISA KEV with known ransomware campaign use and a 30-day EPSS probability of roughly 0.78 (99.5th percentile), indicating active exploitation in the wild. Vendor and ZDI advisories are available for remediation detail.

What to do

• Apply the vendor fix per PaperCut advisory PO-1216/PO-1219 immediately; patch is the primary action.
• If patching is not possible, restrict network access to PaperCut servers (block internet exposure, limit to trusted admin networks) per vendor mitigation guidance.
• Follow BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
• Audit PaperCut servers for signs of prior compromise and rotate credentials and secrets that may have been exposed.
• Monitor for follow-on ransomware activity on hosts running PaperCut.

Detection

• Review PaperCut server logs for authentication bypass patterns or unexpected administrative actions from unauthenticated sessions.
• Hunt for anomalous access to PaperCut web endpoints from external or unusual source IPs.
• Correlate PaperCut host activity with ransomware precursor behaviors such as credential dumping or lateral movement.
• Check for unauthorized configuration changes, new admin accounts, or unexpected print job activity on PaperCut servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.