CVE-2023-39469: PaperCut NG External User Lookup code injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution as SYSTEM with a very high EPSS score, though exploitation requires authenticated privileged access.

What it is

PaperCut NG and MF fail to validate a user-supplied string in the External User Lookup feature before using it to execute Java code. An authenticated attacker can inject code that runs on the server, giving full control of the host. The flaw is remotely reachable and rated high severity (CVSS 7.2).

Impact

An attacker gains arbitrary code execution in the context of SYSTEM, allowing full compromise of the PaperCut server and any data or credentials it holds.

Attack surface

Reachable over the network through the External User Lookup functionality; the CVSS vector (AV:N/AC:L/PR:H/UI:N) indicates high privileges are required and no user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.61 (99th percentile), indicating a high likelihood of exploitation activity; references are vendor and ZDI advisories only.

What to do

• Apply the PaperCut security update from the July 2023 security bulletin (SecurityBulletinJuly2023) to NG and MF installations.
• Restrict access to the PaperCut administration interface to trusted networks and accounts.
• Audit and remove unnecessary privileged accounts that could reach the External User Lookup configuration.
• Review External User Lookup configuration for untrusted or unexpected script or code input.
• Monitor PaperCut server logs for anomalous Java execution or lookup requests.

Detection

• Alert on unexpected child processes or Java code execution spawned by the PaperCut service.
• Monitor PaperCut logs for External User Lookup requests containing script or code-like strings.
• Track authentication and configuration changes to External User Lookup settings by privileged accounts.
• Correlate outbound network connections from the PaperCut host with lookup activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.