CVE-2023-27351

HIGH(7.5)KEVRansomwareLikely Exploited

PaperCut NG/MF Improper Authentication Vulnerability

Description

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.

KEV Information

Vendor
PaperCut
Product
NG/MF
Date Added
April 20, 2026
Due Date
May 4, 2026
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6

CWEs

Affected Products

VendorProductVersion
papercutpapercut mf>= 15.0, < 20.1.7; >= 21.0.0, < 21.2.11; >= 22.0.0, < 22.0.9
papercutpapercut ng>= 15.0, < 20.1.7; >= 21.0.0, < 21.2.11; >= 22.0.0, < 22.0.9

Multiple CVSS Assessments

Source: [email protected](Primary)
7.5
HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: [email protected](Secondary)
8.2
HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

CVSS Score

7.5
HIGH(7.5)

EPSS Score

EPSS Score77.39%
EPSS Percentile99.5%

Dates

PublishedApril 20, 2023
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.