CVE-2023-27351

The vulnerability in question arises from a critical flaw in the authentication mechanism of PaperCut NG and PaperCut MF versions 22.0.5 and earlier. Specifically, the issue is rooted in the SecurityRequestFilter class, where the authentication algorithm has been improperly implemented. This design oversight allows remote attackers to bypass authentication entirely, granting unauthorized access to sensitive functionalities of the affected software. The absence of a requirement for valid credentials to exploit this vulnerability significantly amplifies its severity, as it opens the door for malicious actors to interact with the system without any prior authentication.

Attack vectors for this vulnerability are particularly concerning due to their simplicity and effectiveness. An attacker can initiate a request to the affected PaperCut installations without needing to authenticate, which means that even individuals with minimal technical skills can exploit this flaw. Scenarios could include an attacker gaining access to administrative controls, allowing them to manipulate print jobs, access sensitive documents, or even disrupt services. Furthermore, the potential for lateral movement within a network increases, as the compromised system could serve as a foothold for further attacks, targeting other connected systems or sensitive data repositories.

The real-world impact of this vulnerability is significant, particularly for organizations that rely on PaperCut for print management and related services. The business risks associated with unauthorized access include data breaches, financial loss, and reputational damage. Unauthorized users could exploit the system to print sensitive documents, leading to confidentiality breaches. Additionally, the operational disruption caused by unauthorized manipulation of print jobs could hinder business processes, resulting in lost productivity and increased operational costs. Organizations that fail to address this vulnerability may also face regulatory scrutiny, especially if sensitive data is exposed as a result of an exploit.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regularly updating to the latest versions of PaperCut software is crucial, as vendors typically release patches to address known vulnerabilities. In addition to software updates, organizations should employ network segmentation to limit the exposure of critical systems to potential attackers. Monitoring network traffic for unusual patterns can also help in identifying exploitation attempts. Implementing strong access controls and authentication mechanisms, such as multi-factor authentication, can further reduce the risk of unauthorized access. Conducting regular security assessments and penetration testing will also help organizations identify and remediate vulnerabilities before they can be exploited.

In conclusion, the vulnerability within the authentication mechanism of PaperCut NG and MF poses a significant threat to organizations using these products. The ease of exploitation and potential for severe consequences necessitate immediate attention from affected entities. By adopting proactive detection and mitigation strategies, organizations can safeguard their systems against unauthorized access and mitigate the associated risks. As the cybersecurity landscape continues to evolve, staying informed about vulnerabilities and implementing robust security measures will be essential to protect sensitive information and maintain operational integrity.

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2023-27351, coinciding with its recent inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. This formal recognition underscores the vulnerability’s elevated risk profile, reflected in the updated CVSS score of 8.2 and a significant EPSS score nearing the top percentile, indicating a high likelihood of exploitation attempts in the wild. Our telemetry reveals a sustained upward trend in exploit attempts, signaling increased adversary interest and potential targeting of PaperCut NG installations. Although no new exploit techniques or ransomware associations have been confirmed, the heightened visibility and scoring adjustments necessitate a reassessment of the threat landscape. Consequently, the risk level for organizations running affected PaperCut NG versions has escalated to high, emphasizing the urgency for enhanced monitoring and defensive postures to detect and respond to potential authentication bypass attempts.

Update 2 — May 16, 2026

CSURFACE threat intelligence has detected a slight increase in activity exploiting CVE-2023-27351, reflected by a modest uptick in telemetry signals. While the EPSS score has marginally decreased, the overall trend in exploit attempts remains upward, indicating persistent adversary interest in leveraging this authentication bypass vulnerability. No new exploit variants or ransomware affiliations have been identified, but the continued exploitation attempts underscore the vulnerability’s attractiveness as an attack vector. This subtle shift in the exploitation landscape reinforces the criticality of maintaining vigilant detection capabilities. Consequently, the threat level for organizations using affected PaperCut NG versions remains elevated, with a sustained risk of unauthorized access that could facilitate further compromise.

Update 3 — July 04, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2023-27351, with telemetry indicating a sustained increase in adversary activity leveraging this authentication bypass vulnerability. Concurrently, the CVSS score for this issue has been revised downward to 7.5 from the previous 8.2, reflecting a refined understanding of the vulnerability’s impact and exploitability. Despite this score adjustment, the risk posed by the vulnerability remains significant due to its unauthenticated nature and continued interest from threat actors. The EPSS metric remains stable, suggesting that while exploitation frequency has increased, it has not yet accelerated rapidly. No new exploit variants or ransomware group associations have emerged, but the persistent exploitation attempts underscore the vulnerability’s ongoing attractiveness as an initial access vector. For defenders, this evolving landscape highlights the necessity of maintaining robust detection and monitoring controls, as adversaries continue to probe affected PaperCut NG environments. Overall, the threat level remains elevated, with the increased exploitation activity reinforcing the critical need for vigilance despite the CVSS score reduction.