CVE-2023-27350: PaperCut NG/MF authentication bypass to remote code execution, actively exploited
The short version: PaperCut NG/MF — widely deployed print-management software — has an improper-access-control flaw (CVE-2023-27350) that lets an unauthenticated attacker bypass authentication and execute code in the context of SYSTEM. It scores 9.8, it was exploited in the wild (including by ransomware crews), and it's in CISA's KEV catalog. A companion information-disclosure flaw (CVE-2023-27351) shipped alongside it. If you run an affected PaperCut build, patch now. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — unauthenticated auth-bypass to SYSTEM-level RCE, KEV-listed and ransomware-associated |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Companion flaw | CVE-2023-27351 — information disclosure (also KEV-listed) |
| EPSS | ~99.99% · 99.99th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-05-12; associated with known ransomware campaigns |
| Known exploited? | Yes — exploited in the wild, including by ransomware operators |
| Vulnerability type | CWE-284 improper access control → authentication bypass → remote code execution as SYSTEM |
| Requires authenticated session? | No — authentication is not required |
| Affected | PaperCut MF and NG (versions through 22.0.x before the fixed builds; the SetupCompleted class) |
| Fixed in | 20.1.7, 21.2.11, 22.0.9 (and later) |
What you need to know
PaperCut's admin web interface is the target. CVE-2023-27350 is an improper access control flaw in the SetupCompleted class: an unauthenticated attacker reaches setup functionality that should be locked down, bypasses authentication, and from there executes code. On Windows, the PaperCut Application Server runs as SYSTEM, so that code execution is at the highest local privilege.
- It's pre-authentication and internet-reachable. No credential, no chain — a request to the setup endpoint is the way in.
- Execution runs as SYSTEM. Auth bypass becomes full host compromise.
- It was live and ransomware-linked. Multiple crews used it for initial access; an exposed, unpatched server may already be touched. The companion CVE-2023-27351 (information disclosure) was often paired with it.
How serious we see it
Critical — unauthenticated authentication bypass to SYSTEM-level code execution, confirmed exploited in the wild and used by ransomware operators.
The bounded, reassuring part is that it's narrow and fixable: it affects specific PaperCut MF/NG builds, the fixes (20.1.7 / 21.2.11 / 22.0.9) are published, and exposure is quick to determine. The catch is the usual one for a mass-exploited flaw — being patched and being clean are separate questions, so verify the server wasn't already used.
Recommendations
- Patch now. Upgrade PaperCut MF/NG to 20.1.7 / 21.2.11 / 22.0.9 or later.
- Hunt. Review server logs for access to the setup endpoint and for unexpected activity; PaperCut and Sophos published indicators to check.
- If compromised, respond. Rebuild the host, rotate credentials and secrets it holds, and treat it as a potential ransomware precursor.
- Reduce exposure. Keep the PaperCut admin interface off the public internet; restrict it to trusted networks per PaperCut's guidance.
- Confirm your exposure first. Verify whether you run an affected PaperCut build and whether the admin interface is reachable.
How BreachRisk sees it
BreachRisk discovers internet-facing PaperCut login panels from little more than your domain, fingerprints the product and version, and flags exposure tied to this KEV-listed, actively exploited flaw — surfaced at the top of your results because it's in KEV and ransomware-associated. We detect and prioritize the exposed, affected server; the continuous outside-in view means a known-exploited print server is already mapped, so you can go straight to patch-and-verify.