NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

PaperCut NG/MF authentication bypass CVE-2023-27351 used in attacks, including ransomware

Attackers are exploiting an old PaperCut NG/MF flaw that exposes user account information without a login. Fixes have existed since March 2023. Ask your organisation's IT team to update its print-management server and check for compromise.

What to do

Ask your organisation's IT team or PaperCut reseller to update the server to a current supported release; the first fixes were 20.1.7, 21.2.11 and 22.0.9. Ask them to check for compromise too: PaperCut recommends rebuilding a suspected compromised application server from a safe backup.

What’s happening

CVE-2023-27351 lets remote attackers bypass authentication on vulnerable PaperCut NG/MF application servers and retrieve user information without logging in. Exposed information can include names, email addresses, departments, associated card numbers and password hashes for accounts created within PaperCut; directory-synchronised accounts' password hashes are excluded. It affects organisations running the vulnerable print-management servers. PaperCut released fixes in March 2023, but Microsoft reported exploitation by Medusa ransomware operator Storm-1175 in April 2026, and CISA added the flaw to its exploited catalogue on 20 April. PaperCut's advisory still says it has no evidence of this particular flaw being used against customers, which conflicts with those later findings. As at 3 November 2026, fixes remain available and CISA records known ransomware use. The sources reviewed do not establish when exploitation of this specific flaw first began or that attacks have ended.

What
Flaw
Affects
PaperCut NG and MF print-management application servers
Affected
PaperCut NG/MF Application Server 15.0.0–19.2.7, all operating systems
PaperCut NG/MF Application Server 20.0.0–20.1.6, all operating systems
PaperCut NG/MF Application Server 21.0.0–21.2.10, all operating systems
PaperCut NG/MF Application Server 22.0.0–22.0.8, all operating systems
Fixed in
PaperCut NG/MF 20.1.7
PaperCut NG/MF 21.2.11
PaperCut NG/MF 22.0.9 and later
CVE
CVE-2023-27351
Since
20 Apr 2026
Closed
21 Apr 2026

Timeline

  1. Update

    HKCERT warned that CVE-2023-27351 was being exploited and directed administrators to the existing PaperCut fixes.

  2. CISA added

    CISA added CVE-2023-27351 to its Known Exploited Vulnerabilities catalogue, with a federal remediation deadline of 4 May. Its current entry also records known ransomware use.

  3. Wider attacks

    Microsoft named CVE-2023-27351 among vulnerabilities exploited by Storm-1175, an operator conducting data theft and Medusa ransomware attacks.

  4. Made public

    Trend Micro's Zero Day Initiative published its advisory for CVE-2023-27351, describing a flaw in SecurityRequestFilter that lets remote attackers bypass authentication.

  5. New fixFixed

    PaperCut disclosed the vulnerability and released NG/MF 20.1.7, 21.2.11 and 22.0.9 with fixes. It notified partners and security mailing-list subscribers.

Sources

  1. URGENT MF/NG vulnerability bulletin (March 2023)PaperCut · 29 Sept 2026
  2. PaperCut NG SecurityRequestFilter Authentication Bypass VulnerabilityTrend Micro Zero Day Initiative · 14 Mar 2023
  3. Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operationsMicrosoft · 6 Apr 2026
  4. Known Exploited Vulnerabilities catalogue — 3 November 2026 editionCISA · 3 Nov 2026
  5. PaperCut Multiple VulnerabilitiesHKCERT · 21 Apr 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from April 2026 · JSON · RSS