---
id: "CVE-2023-27351"
kind: "vulnerability"
aliases: ["CVE-2023-27351"]
title: "This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5\u2026"
severity: "critical"
cvss: 8.2
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "PaperCut NG/MF", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "papercut mf", "fixed": ["20.1.7"], "affected": ">= 15.0, < 20.1.7", "ecosystem": "vendor"}, {"name": "papercut mf", "fixed": ["21.2.11"], "affected": ">= 21.0.0, < 21.2.11", "ecosystem": "vendor"}, {"name": "papercut mf", "fixed": ["22.0.9"], "affected": ">= 22.0.0, < 22.0.9", "ecosystem": "vendor"}, {"name": "papercut ng", "fixed": ["20.1.7"], "affected": ">= 15.0, < 20.1.7", "ecosystem": "vendor"}, {"name": "papercut ng", "fixed": ["21.2.11"], "affected": ">= 21.0.0, < 21.2.11", "ecosystem": "vendor"}, {"name": "papercut ng", "fixed": ["22.0.9"], "affected": ">= 22.0.0, < 22.0.9", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "papercut", "print-server", "ransomware", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "unaffected-version"]
published_at: "2023-04-20T16:15:07+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27351", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27351", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5…

PaperCut NG and PaperCut MF print management servers contain an improper authentication flaw in the SecurityRequestFilter class. A remote attacker can bypass login on affected installs and reach administrative functions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PaperCut NG/MF affected ? fixed ?
- vendor:papercut mf affected >= 15.0, < 20.1.7 fixed 20.1.7
- vendor:papercut mf affected >= 21.0.0, < 21.2.11 fixed 21.2.11
- vendor:papercut mf affected >= 22.0.0, < 22.0.9 fixed 22.0.9
- vendor:papercut ng affected >= 15.0, < 20.1.7 fixed 20.1.7
- vendor:papercut ng affected >= 21.0.0, < 21.2.11 fixed 21.2.11
- vendor:papercut ng affected >= 22.0.0, < 22.0.9 fixed 22.0.9

## Fix

Apply the mitigation or patched build from PaperCut's vendor advisory; the sources do not name the fixed version. Follow CISA BOD 22-01 guidance if the product is cloud-hosted, or stop using it if no mitigation exists.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27351
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-27351

## From the sources

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_