{"id":"papercut-authentication-bypass-exploited-apr-2026","category":"patch","status":"closed","title":"PaperCut NG/MF authentication bypass CVE-2023-27351 used in attacks, including ransomware","tldr":"Attackers are exploiting an old PaperCut NG/MF flaw that exposes user account information without a login. Fixes have existed since March 2023. Ask your organisation's IT team to update its print-management server and check for compromise.","summary":"CVE-2023-27351 lets remote attackers bypass authentication on vulnerable PaperCut NG/MF application servers and retrieve user information without logging in. Exposed information can include names, email addresses, departments, associated card numbers and password hashes for accounts created within PaperCut; directory-synchronised accounts' password hashes are excluded. It affects organisations running the vulnerable print-management servers. PaperCut released fixes in March 2023, but Microsoft reported exploitation by Medusa ransomware operator Storm-1175 in April 2026, and CISA added the flaw to its exploited catalogue on 20 April. PaperCut's advisory still says it has no evidence of this particular flaw being used against customers, which conflicts with those later findings. As at 3 November 2026, fixes remain available and CISA records known ransomware use. The sources reviewed do not establish when exploitation of this specific flaw first began or that attacks have ended.","action":"Ask your organisation's IT team or PaperCut reseller to update the server to a current supported release; the first fixes were 20.1.7, 21.2.11 and 22.0.9. Ask them to check for compromise too: PaperCut recommends rebuilding a suspected compromised application server from a safe backup.","product":"PaperCut NG and MF print-management application servers","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2023-27351"],"tags":["papercut","print-management","authentication-bypass","information-disclosure","ransomware"],"affected":["PaperCut NG/MF Application Server 15.0.0–19.2.7, all operating systems","PaperCut NG/MF Application Server 20.0.0–20.1.6, all operating systems","PaperCut NG/MF Application Server 21.0.0–21.2.10, all operating systems","PaperCut NG/MF Application Server 22.0.0–22.0.8, all operating systems"],"fixed":["PaperCut NG/MF 20.1.7","PaperCut NG/MF 21.2.11","PaperCut NG/MF 22.0.9 and later"],"matches":[],"sources":[{"kind":"advisory","title":"URGENT MF/NG vulnerability bulletin (March 2023)","url":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219","by":"PaperCut","date":"2026-09-29"},{"kind":"advisory","title":"PaperCut NG SecurityRequestFilter Authentication Bypass Vulnerability","url":"https://www.zerodayinitiative.com/advisories/ZDI-23-232/","by":"Trend Micro Zero Day Initiative","date":"2023-03-14"},{"kind":"research","title":"Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations","url":"https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/","by":"Microsoft","date":"2026-04-06"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue — 3 November 2026 edition","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"advisory","title":"PaperCut Multiple Vulnerabilities","url":"https://www.hkcert.org/security-bulletin/papercut-multiple-vulnerabilities_20260421","by":"HKCERT","date":"2026-04-21"}],"started":"2026-04-20","closed":"2026-04-21","created":"2026-11-03T22:07:20.650Z","updated":"2026-11-03T22:07:20.650Z","cve_notes":[{"cve":"CVE-2023-27351","name":"PaperCut NG/MF authentication bypass exposes user data","what":"Incorrect authentication in PaperCut NG/MF's SecurityRequestFilter lets remote attackers retrieve stored user information without logging in, including password hashes for internal PaperCut accounts.","severity":"high","cvss":8.2}],"timeline":[{"at":"2026-04-21","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"HKCERT warned that CVE-2023-27351 was being exploited and directed administrators to the existing PaperCut fixes.","url":"https://www.hkcert.org/security-bulletin/papercut-multiple-vulnerabilities_20260421","by":"HKCERT","patch":null},{"at":"2026-04-20","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2023-27351 to its Known Exploited Vulnerabilities catalogue, with a federal remediation deadline of 4 May. Its current entry also records known ransomware use.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-04-06","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Microsoft named CVE-2023-27351 among vulnerabilities exploited by Storm-1175, an operator conducting data theft and Medusa ransomware attacks.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/","by":"Microsoft","patch":null},{"at":"2023-03-14","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Trend Micro's Zero Day Initiative published its advisory for CVE-2023-27351, describing a flaw in SecurityRequestFilter that lets remote attackers bypass authentication.","url":"https://www.zerodayinitiative.com/advisories/ZDI-23-232/","by":"Trend Micro Zero Day Initiative","patch":null},{"at":"2023-03-08","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"PaperCut disclosed the vulnerability and released NG/MF 20.1.7, 21.2.11 and 22.0.9 with fixes. It notified partners and security mailing-list subscribers.","url":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219","by":"PaperCut","patch":"patched"}],"url":"https://hard.fyi/live/papercut-authentication-bypass-exploited-apr-2026/","json":"https://hard.fyi/api/live?id=papercut-authentication-bypass-exploited-apr-2026"}