PaperCut NG/MF Remote Authentication Bypass (CVE-2023-27351)

Historical catalog analysis: CISA added this entry on April 20, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2023-27351 is an improper authentication vulnerability (CWE-287) affecting PaperCut NG/MF. The flaw resides within the SecurityRequestFilter class, which could allow a remote attacker to bypass authentication mechanisms on affected installations. This vulnerability has been identified as having known use by ransomware campaigns.

Exposure and applicability

This vulnerability applies to organizations deploying PaperCut NG/MF. Because the flaw allows for remote authentication bypass, any instance of the software exposed to untrusted networks or accessible by unauthorized internal actors is at risk. The inclusion of this CVE in CISA’s Known Exploited Vulnerabilities (KEV) catalog indicates that the vulnerability is actively being leveraged in the wild.

Remediation priorities

Based on the reported exploitation by ransomware actors, remediation should be prioritized for all internet-facing and high-privilege internal print management servers. Our analysis suggests the following priority sequence:

1. Immediate Mitigation: Apply vendor-provided mitigations as specified in PaperCut’s official guidance.
2. Cloud Service Review: For organizations utilizing cloud-based deployments, review configurations against BOD 22-01 guidance to ensure appropriate security boundaries.
3. Decommissioning: If the specific version in use cannot be mitigated via vendor patches or workarounds, our analysis suggests discontinuing the use of the product to eliminate the exposure path.

How to validate remediation

Verification must move beyond simple version checks, as a deployed patch does not inherently guarantee that the vulnerability is neutralized in the runtime environment. Defenders should focus on verifying the result of the mitigation:

• Authentication Testing: Attempting to access protected administrative interfaces without valid credentials to confirm that the SecurityRequestFilter class no longer permits unauthorized bypass.
• Configuration Audit: Verifying that vendor-recommended configuration changes are active and enforced across all nodes in the print environment.
• Log Analysis: Reviewing authentication logs for anomalous patterns that would indicate attempted bypasses of the security filter.

Limits and open questions

While vendor mitigations are available, there is residual risk if the mitigation is applied inconsistently across a distributed environment. It remains unclear from the source whether specific versions of PaperCut NG/MF are immune or if the vulnerability exists across all legacy iterations of the SecurityRequestFilter class. Furthermore, while applying patches reduces the likelihood of initial access, it does not address potential persistence already established by attackers who may have exploited the flaw prior to remediation.

Source and editorial note

CVE-2023-27351: PaperCut NG/MF Improper Authentication Vulnerability · Source date: April 20, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: April 23, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 14, 2026 at 00:05 UTC.

Request a Vulnerability Assessment