CVE-2023-27351
PaperCut NG/MF Improper Authentication Vulnerability
Description
CVE-2023-27351 is a CRITICAL severity authentication bypass vulnerability in PaperCut NG and PaperCut MF, widely deployed print management software used across enterprise, education, healthcare, and government environments. The flaw resides in the SecurityRequestFilter class within PaperCut's application server, which is responsible for enforcing authentication and authorization on incoming HTTP requests. Remote unauthenticated attackers can bypass this filter to access protected functionality — including administrative APIs and application management features — without providing valid credentials. PaperCut installations are deeply embedded in organizational networks, often running with broad access to print queues, user data, and network shares, making an unauthenticated bypass of the security layer a critical compromise vector. CVE-2023-27351 was publicly disclosed and actively exploited in April 2023, and was famously leveraged in ransomware campaigns by threat actors including Bl00dy and Clop ransomware affiliates. CISA added CVE-2023-27351 to the Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, with a remediation due date of May 4, 2026 — a reaffirmation of continued exploitation activity years after initial disclosure. The EPSS score is an exceptional 0.86104, placing this vulnerability at the 99.4th percentile: among the top 1% of all CVEs by predicted exploitation probability, reflecting sustained, near-certain real-world exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| papercut | papercut mf | >= 15.0, < 20.1.7; >= 21.0.0, < 21.2.11; >= 22.0.0, < 22.0.9 |
| papercut | papercut ng | >= 15.0, < 20.1.7; >= 21.0.0, < 21.2.11; >= 22.0.0, < 22.0.9 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219(Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-23-232/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27351(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CWE-287 describes situations where software does not correctly verify the identity of a user, service, or device that is attempting to access a resource or perform an action. Improper authentication can manifest as missing authentication on security-critical functions, authentication that can be bypassed by manipulating request parameters or headers, or authentication logic that is correctly applied in most code paths but skipped in specific circumstances due to filter ordering, condition logic errors, or route-matching flaws. The impact of CWE-287 is typically severe because authentication is the foundational gating mechanism for all subsequent authorization and access control decisions — bypassing it renders all downstream security controls irrelevant.
In CVE-2023-27351, the authentication bypass is rooted in PaperCut's SecurityRequestFilter class, a servlet filter in the Java-based PaperCut application server that is responsible for intercepting incoming HTTP requests and enforcing authentication before allowing access to protected application endpoints. The bypass allows an attacker to send requests to protected endpoints in a way that causes the SecurityRequestFilter to incorrectly conclude that the request is already authenticated or exempt from authentication, granting unauthorized access to administrative functionality. This class of filter-bypass vulnerability is common in Java web applications where security filters operate on URL pattern matching, and subtle differences between filter-evaluated paths and actual servlet dispatch paths can be exploited to reach protected resources without passing through the security filter. Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2023-27351 is a CRITICAL severity vulnerability. While an official CVSS vector from NVD was not universally standardized at time of initial disclosure, independent analysis and vendor guidance classify it as critical based on the following factors.
CVSS 3.1 Contextual Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — Score: 9.8 (CRITICAL)
Attack Vector (Network): PaperCut's application server management interface is a network-accessible web application, typically exposed on TCP port 9191 (HTTP) or 9192 (HTTPS). In many deployments it is reachable from corporate LAN without restriction.
Attack Complexity (Low): The authentication bypass does not require special timing, environmental conditions, or prior information gathering. An attacker who can reach the PaperCut server can exploit it in a single HTTP request or a short sequence of requests.
Privileges Required (None): No account credentials are necessary. The bypass circumvents the authentication layer entirely, making the vulnerability exploitable by any network-adjacent attacker or anyone who can route to the PaperCut server.
User Interaction (None): Exploitation is entirely attacker-controlled.
Confidentiality (High): Unauthenticated access to PaperCut's administrative interface exposes user account data (including usernames, email addresses, cost center assignments), print job metadata, and potentially network share credentials configured for print delivery.
Integrity (High): Admin access enables script execution via PaperCut's built-in scripting engine (scripting is a documented PaperCut feature for print job processing), account manipulation, and configuration changes — all of which directly impact integrity.
Availability (High): Print infrastructure disruption and system compromise leading to ransomware deployment have both been documented outcomes of this vulnerability's exploitation.
Prioritization Guidance: The 99.4th percentile EPSS score, confirmed ransomware campaign exploitation, CISA KEV listing with continued due-date enforcement in 2026, and the unauthenticated remote nature of the bypass make CVE-2023-27351 an absolute top-priority remediation regardless of when the organization last reviewed it.
Exploit Maturity
Confirmed Ransomware Exploitation: CVE-2023-27351 has been confirmed as actively exploited in ransomware campaigns. The Bl00dy ransomware group and Clop ransomware affiliates were publicly documented by CISA and multiple threat intelligence vendors in May 2023 as exploiting this vulnerability (and the companion CVE-2023-27350) to gain initial access to victim networks, deploy payloads including remote access trojans and ransomware, and exfiltrate data. PaperCut servers are particularly valuable initial-access targets because they are often domain-joined Windows servers with broad network connectivity, making lateral movement straightforward post-compromise.
EPSS Context — 99.4th Percentile: An EPSS score of 0.86104 (99.4th percentile) means this vulnerability is predicted to be exploited with approximately 86% probability within 30 days — one of the highest EPSS scores in the CVE database. This reflects the combination of: public exploit code availability, confirmed ransomware campaign use, wide deployment of PaperCut in enterprise and educational environments, and the low barrier (zero authentication) to exploitation. Vulnerabilities at this EPSS level are near-certainties for exploitation attempts against any exposed instance.
Public Exploit Code: Multiple public proof-of-concept exploits for CVE-2023-27351 were released in April–May 2023 by security researchers. Metasploit modules and standalone PoC scripts are available, making exploitation accessible to low-skill attackers. This directly contributes to the near-ceiling EPSS score.
Sustained Exploitation: The CISA re-listing on April 20, 2026 — three years after initial disclosure — confirms that unpatched PaperCut instances continue to be targeted. Long-tail exploitation of well-known CWE-287 vulnerabilities in business applications is a common pattern, particularly in educational and healthcare sectors where patch cycles can be slow.
KEV Listing: Initial KEV listing occurred in 2023. The April 20, 2026 re-listing with a May 4, 2026 due date indicates CISA is actively observing continued exploitation and is mandating re-verification of remediation across federal agencies.
Remediation
-
Comply with the CISA KEV directive. CISA mandates remediation of CVE-2023-27351 by May 4, 2026. Federal agencies must meet this deadline. All other organizations must verify they have patched and should treat any unpatched PaperCut instance as an active compromise risk requiring immediate incident response.
-
Upgrade PaperCut NG and MF to patched versions. The vulnerability is fixed in PaperCut MF and NG versions 20.1.7, 21.2.11, 22.0.9 and later. Verify the installed version via the PaperCut Admin web interface at About > Version Information, and upgrade to the latest available release following PaperCut's official upgrade documentation at papercut.com/support.
-
Restrict access to the PaperCut application server immediately. As a critical interim mitigation if patching cannot be performed within hours: block external access to PaperCut's HTTP/HTTPS management ports (9191/9192) at the network perimeter and internal firewall. Ensure PaperCut is accessible only from the print server's local host or from dedicated administrator workstations. PaperCut's own guidance recommends restricting access to the admin interface as the primary pre-patch mitigation.
-
Check for indicators of compromise. Given the EPSS score of 99.4th percentile and confirmed ransomware campaigns, assume compromise may have already occurred on unpatched systems. Review PaperCut application logs for unusual API calls, administrative actions performed without an authenticated user session, script execution events, and new user account creation. Check for unexpected files written to the PaperCut server's file system and look for lateral movement indicators.
-
Hunt for known threat actor indicators. The Bl00dy and Clop ransomware groups are known to have exploited CVE-2023-27351. Threat intelligence sources document associated IOCs (IP addresses, file hashes, C2 domains) — correlate these against your SIEM, EDR, and network flow data for the PaperCut server and its network neighbors.
-
Harden PaperCut post-patching. Apply PaperCut's security hardening guide: disable built-in scripting if not in use (this was used as a code execution vector in attacks), enforce HTTPS-only administration, enable audit logging for all administrative actions, and run PaperCut under a least-privileged service account. Segment the PaperCut server from user workstations and domain controllers to limit lateral movement impact.
Technical Details
CVE-2023-27351 is an authentication bypass vulnerability in PaperCut NG and PaperCut MF, Java-based print management server applications.
Architecture Context: PaperCut's application server is built on a Java servlet framework (historically Jetty). The web application uses a servlet filter chain to process incoming HTTP requests, with the SecurityRequestFilter serving as the primary authentication enforcement point. The filter is registered to intercept requests to protected URL patterns and verify that the caller presents a valid session or authentication credential before allowing the request to proceed to the servlet or REST handler.
Root Cause — SecurityRequestFilter Bypass: The vulnerability arises from a flaw in how the SecurityRequestFilter class evaluates whether a given request requires authentication. Java servlet filters operate on URL patterns specified in the web application's deployment descriptor (web.xml) or via annotation. A well-known class of bypass exists when the filter's URL matching logic differs from the URL resolution used by the underlying servlet container to dispatch requests to servlets. By crafting a URL that matches a protected servlet's handling path but does not match the filter's protection pattern — or by exploiting how the filter handles path parameters, encoded slashes, or specific request metadata — an attacker can reach the protected servlet without the SecurityRequestFilter applying authentication checks.
Exploitation Path: A remote attacker sends an unauthenticated HTTP request to the PaperCut admin interface with a crafted URL that bypasses the SecurityRequestFilter. Upon reaching an unprotected administrative endpoint, the attacker can invoke application APIs: reading user data, modifying configuration, or — most critically — invoking PaperCut's built-in print scripting engine. PaperCut supports server-side JavaScript scripts for print job processing. These scripts can execute operating system commands via Java's Runtime.exec() or ProcessBuilder, giving the attacker arbitrary command execution on the PaperCut server with the privilege level of the PaperCut service account (often SYSTEM on Windows).
Affected Versions: PaperCut MF and NG versions prior to 20.1.7, 21.2.11, and 22.0.9 across all supported platforms (Windows, Linux, macOS). The vulnerability was disclosed in April 2023 alongside CVE-2023-27350 (a related but distinct critical vulnerability). Both are frequently discussed together in threat intelligence reporting.
Vendor Advisory: PaperCut Security Advisory at papercut.com/security/advisory/PO-1216-8140. CISA ICS Advisory and multiple vendor threat intelligence reports cover this vulnerability in detail.
Frequently Asked Questions
Is CVE-2023-27351 still being actively exploited in 2026?
Yes. Despite being disclosed in April 2023, CISA re-added CVE-2023-27351 to the KEV catalog in April 2026 with a new remediation deadline, confirming that exploitation continues against unpatched PaperCut installations. The 99.4th percentile EPSS score confirms the vulnerability remains one of the highest-probability exploitation targets in the CVE database. Organizations that have not yet patched are at high risk of compromise.
What products are affected?
PaperCut MF and PaperCut NG prior to versions 20.1.7, 21.2.11, and 22.0.9 are affected across all supported platforms (Windows, macOS, Linux). The vulnerability is in the core application server; all deployment configurations are affected unless the patch has been applied.
Has this been used in ransomware attacks?
Yes. The Bl00dy ransomware group and Clop ransomware affiliates were documented as exploiting CVE-2023-27351 in 2023. The authentication bypass provides unauthenticated remote access to PaperCut's administrative interface, which attackers leverage to execute operating system commands via PaperCut's scripting engine, giving them a foothold on domain-joined servers ideal for ransomware deployment.
How do I fix it?
Upgrade PaperCut MF or NG to version 20.1.7, 21.2.11, 22.0.9, or later. As an immediate interim step, block all external access to PaperCut's management ports (9191/9192) and restrict access to administrator workstations only. On any system that may have been exposed while unpatched, conduct a full compromise assessment including log review and file system inspection before restoring to production use.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.