---
id: "CVE-2023-27350"
kind: "vulnerability"
aliases: ["CVE-2023-27350"]
title: "This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "PaperCut MF/NG", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "PaperCut MF/NG", "fixed": ["20.1.7", "21.2.11", "22.0.9"], "affected": ">= 8.0.0, <= 19.2.7; >= 20.0.0, <= 20.1.6; >= 21.0.0, <= 21.2.10; >= 22.0.0, <= 22.0.8", "ecosystem": "vendor"}, {"name": "papercut mf", "fixed": ["20.1.7"], "affected": ">= 8.0, < 20.1.7", "ecosystem": "vendor"}, {"name": "papercut mf", "fixed": ["21.2.11"], "affected": ">= 21.0.0, < 21.2.11", "ecosystem": "vendor"}, {"name": "papercut mf", "fixed": ["22.0.9"], "affected": ">= 22.0.0, < 22.0.9", "ecosystem": "vendor"}, {"name": "papercut ng", "fixed": ["20.1.7"], "affected": ">= 8.0, < 20.1.7", "ecosystem": "vendor"}, {"name": "papercut ng", "fixed": ["21.2.11"], "affected": ">= 21.0.0, < 21.2.11", "ecosystem": "vendor"}, {"name": "papercut ng", "fixed": ["22.0.9"], "affected": ">= 22.0.0, < 22.0.9", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "papercut-mf", "papercut-ng", "ransomware", "runtime", "self-hosted", "windows"]
not_affected_if: ["managed-hosting"]
published_at: "2023-04-20T16:15:07+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27350", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:07:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27350", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5…

PaperCut MF/NG print management servers have an improper access control flaw in the SetupCompleted class. An unauthenticated attacker can bypass authentication and run code as the SYSTEM account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PaperCut MF/NG affected ? fixed ?
- vendor:PaperCut MF/NG affected >= 8.0.0, <= 19.2.7; >= 20.0.0, <= 20.1.6; >= 21.0.0, <= 21.2.10; >= 22.0.0, <= 22.0.8 fixed 20.1.7, 21.2.11, 22.0.9
- vendor:papercut mf affected >= 8.0, < 20.1.7 fixed 20.1.7
- vendor:papercut mf affected >= 21.0.0, < 21.2.11 fixed 21.2.11
- vendor:papercut mf affected >= 22.0.0, < 22.0.9 fixed 22.0.9
- vendor:papercut ng affected >= 8.0, < 20.1.7 fixed 20.1.7
- vendor:papercut ng affected >= 21.0.0, < 21.2.11 fixed 21.2.11
- vendor:papercut ng affected >= 22.0.0, < 22.0.9 fixed 22.0.9

## How to check

Check the version under Admin > About. Vulnerable if 8.0.0-19.2.7, 20.0.0-20.1.6, 21.0.0-21.2.10 or 22.0.0-22.0.8 (Application and Site Servers). Look for pc-app.exe spawning cmd.exe or powershell.exe. Review the Application Server log for 'SetupCompleted' lines (server/logs/server.log, debug mode only) outside install or upgrade times, and for '[setup-wizard]' config-key changes. Review printer Scripting for new print scripts. Look for unexpected admin logins or SSH authorized_keys entries. Check DNS and proxy logs for the domains listed in the bulletin.

## Fix

Upgrade Application Servers and Site Servers to 20.1.7, 21.2.11 or 22.0.9 or later. Secondary servers (Print Providers) are not affected. If you can't upgrade, block inbound traffic to ports 9191 and 9192 from external IPs. If you suspect compromise, back up, rebuild the server and restore the database from a clean backup.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27350
- 2026-10-23T21:07:44+00:00 analyst — PaperCut's own bulletin (PO-1216) gives affected/fixed versions, IOCs and a process-creation detection rule; it confirms exploitation in the wild since 14 Apr 2023. I did not look for a public PoC link.
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-27350

## Documents

- [advisory] PaperCut MF/NG vulnerability bulletin (March 2023) https://www.papercut.com/kb/Main/PO-1216-and-PO-1219

## From the sources

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_