CVE-2023-27350

Think of PaperCut like the “front desk” that controls who can manage printing. This flaw lets an attacker bypass that front desk check—no login needed—and then push commands that run with the highest power on the server. In real attacks, that can quickly turn into ransomware or other damage.

This matters if your organization uses PaperCut NG or PaperCut MF to manage print jobs or related settings. It’s especially important for companies where the PaperCut server is reachable from the internet or from untrusted networks. This is a risk without authentication—attackers only need network reachability to the vulnerable service.

This is RED because real attackers have been using this flaw in ransomware campaigns (CISA KEV). Public exploits exist and the vulnerability allows unauthenticated remote compromise with SYSTEM-level impact, so delays directly increase your likelihood of being targeted.

Confirm whether you’re exposed

• Identify the PaperCut component(s) you run: PaperCut NG or PaperCut MF.
• Check your exact PaperCut version and build number on the server. The issue is described for PaperCut NG 22.0.5 (Build 63914), and you should treat any corresponding vulnerable release/build as exposed until your installed version is confirmed to be fixed.

Upgrade to the fixed version (primary remediation)

• Upgrade PaperCut NG to 20.1.7.
• Upgrade PaperCut MF to 20.1.7.
• Use vendor guidance for the upgrade method from PaperCut’s remediation pages (PO-1216 and PO-1219).

Verification after patching

• Re-check the running version/build on the PaperCut server after the upgrade.
• Confirm PaperCut services are healthy and that normal printing/management functions work.

If you cannot patch immediately

• Reduce exposure by ensuring the PaperCut server is not directly reachable from the internet.
• Limit access to trusted internal networks only (e.g., firewall rules/VPN access), since exploitation does not require authentication.
• Increase monitoring for unusual authentication bypass attempts, unexpected process execution, and changes consistent with compromise while the upgrade is pending.

KEV timing note

• CISA KEV remediation due date was 2023-05-12; treat this as already overdue in practice for any exposed environment.

What to monitor

• Signs of compromise on the PaperCut server (new services/processes, abnormal scheduled tasks, unexpected outbound connections).
• PaperCut server logs around setup/initialization-related activity and any error patterns that appear correlated with requests to the vulnerable handling.

CVE-2023-27350 is rated critical (CVSS 9.8) and is documented as allowing remote attackers to bypass authentication and execute arbitrary code on PaperCut NG/MF. The weakness is improper access control (CWE-284) affecting SetupCompleted handling. CISA KEV confirms it has been used in ransomware campaigns and lists remediation actions; this is consistent with exploitation-focused findings (weaponized/public exploit availability). A fixed release is available: PaperCut NG and PaperCut MF are fixed in 20.1.7. Public exploit code exists (multiple known variants), and exploitation maturity is high due to confirmed real-world use.