CVE-2023-2533

PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF

Exploited in the wild. In CISA KEV since 2025‑07‑28. A vendor fix is available.

CVSS 3.18.4High EPSS percentile98th29% chance in 30 days CISA KEVListedsince 2025-07-28, due 2025-08-18
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2023-06-20Updated 2026-02-26Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your PaperCut MF/NG version (and build) in the PaperCut admin console or About/Help page.
Compare your version against the vendor’s fixed releases: PaperCut MF/NG fixed in 20.1.8; PaperCut NG/MF fixed in 2.1.1, 20.1.8, or 21.2.12.
Upgrade to the first available fixed version for your product branch (follow the vendor Security Bulletin).
If you cannot patch immediately, follow the mitigations described by the vendor Security Bulletin for this issue, or discontinue use of the product until mitigations are in place (per CISA KEV guidance).

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.

In plain language

Written by AI from the record

CVE-2023-2533 is a real-world exploited security flaw in PaperCut MF/NG that can let an attacker take over servers by tricking an admin (with an active login) via a malicious link—if your business uses PaperCut, you should act now.

CVE-2023-2533 is a Cross-Site Request Forgery (CSRF) issue in PaperCut MF/NG that, when an admin is already logged in, can be used to alter security settings and potentially achieve remote code execution; it is listed in CISA KEV with active exploitation.

If you're affected

Server compromise
Malicious code execution
Security settings tampering
Service disruption

What is it

PaperCut MF/NG is a print management system used by many organizations. This flaw can be triggered when an administrator is already logged into PaperCut and is tricked into clicking a malicious link. In real attacks, that can lead to serious compromise of the system running PaperCut—like an attacker getting the ability to run harmful code or change security settings.

Who is affected

This matters if your business runs PaperCut MF/NG (PaperCut NG/MF) and you have administrators who can log into it. The risk is tied to whether an attacker can reach the PaperCut web interface and get an admin to interact with a crafted link while they have an active login session. CISA’s KEV guidance requires action for affected deployments because this has been exploited in the real world.

How urgent is it

This is urgent because it’s confirmed in CISA KEV as actively exploited, and a public exploit is available. Attackers have been using this weakness in the wild to compromise PaperCut systems, so patching can’t wait.

What to do — in detail

Confirm the installed version/build
- In the PaperCut admin interface, find the version/build information (commonly under About/Help).
- Record the exact PaperCut product name (mf/NG/NG/MF) and version.
Determine whether you are vulnerable based on fixed versions
- Upgrade planning targets (from vendor patch information):
  - papercut mf / papercut ng: fixed in 20.1.8
  - PaperCut NG/MF: fixed in 2.1.1, 20.1.8, or 21.2.12
- If your version is older than the relevant fixed release for your branch, you should treat it as exposed.
Patch immediately to the fixed release for your branch
- Follow the vendor’s Security Bulletin June 2023 for the correct upgrade steps and any upgrade prerequisites.
- Ensure the system is fully updated on all nodes where PaperCut is installed.
If patching is delayed
- Apply the vendor’s mitigations described in the Security Bulletin.
- If mitigations are unavailable or cannot be applied safely, CISA KEV guidance says to discontinue use of the product until mitigations are in place.
CISA timeline
- CISA remediation due date for this KEV entry is 2025-08-18.
What to monitor after updating
- Review PaperCut application logs and web access logs for signs of malicious requests around the time of admin web activity.
- Monitor for unexpected configuration/security setting changes on the PaperCut server.
- If you find suspicious activity, follow your incident response process and consider engaging your security vendor/managed service provider.

Technical context

CVE-2023-2533 is a CWE-352 Cross-Site Request Forgery (CSRF) vulnerability in PaperCut MF/NG. Under specific conditions, an attacker can abuse a logged-in admin session by inducing the admin to make a malicious request (e.g., via a crafted link), which can lead to security setting changes and potentially remote code execution.

Exploitation status: Confirmed exploitation is indicated by CISA KEV (listed; added 2025-07-28) and a public weaponized exploit is available. PULSE reporting cites actor LockBit, which aligns with the KEV “active exploitation” posture.

KEV meaning here: KEV means U.S. agencies have determined this vulnerability requires action due to confirmed real-world exploitation, and CISA provides required remediation guidance and a due date.

Patch availability: Vendor fixed releases include PaperCut MF/NG fixed in 20.1.8; PaperCut NG/MF fixed in 2.1.1, 20.1.8, and 21.2.12. EPSS is not used to soften urgency because KEV/real-world exploitation takes precedence over prediction.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS98th

Public exploit

CISA KEV

Listed as exploited in the wild since 2025-07-28.

US federal agencies must remediate by 2025-08-18.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

29% chance of exploitation activity in the next 30 days, which ranks it in the 98th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 8 days before any public exploit.

2026-06-25OpenVAS check added
2026-03-06Public exploit / PoCsource: other
2026-02-26Patch availablerecord updated
2025-07-28Added to CISA KEV
2023-06-20Publishedweakness classified, att&ck mapped

Affected products

PaperCutcommercial · USaka paper cut
- papercut mfDesktop AppOn-premSecurity Products / vuln-mgmt-scanner
- papercut ngDesktop AppOn-premSecurity Products / vuln-mgmt-scanner
- PaperCut NG/MFSecurity ProductOn-premSecurity Products / endpoint-av-edr

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Scored 8.4 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable