# PaperCut NG/MF auth bypass to remote code execution

Source: https://startwithidentity.com/cves/cve-2023-27350/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

PaperCut NG/MF allowed an unauthenticated caller to reach a setup/scripting surface and execute code (ZDI-CAN-18987). [CVE-2023-27351](https://startwithidentity.com/cves/cve-2023-27351/) is the companion improper-authentication ID. Horizon3 published a public PoC. CISA KEV. Bloody/Bl00dy and other ransomware crews used it in April-May 2023. Fixed in 22.0.9 / 21.2.11 / 20.1.7.

## Why it matters

Print management is not "facilities software." It binds to AD, stores user sync credentials, and sits on the internal network with a forgotten admin UI. An auth bypass there is an identity foothold that never touches the [IdP](https://startwithidentity.com/glossary/identity-provider/).

## What to do

- Confirm every NG/MF application and site server is past those builds. Hive/Pocket were not affected.
- Rotate the AD account PaperCut uses to sync users.
- Take port 9191/9192 off the internet. Hunt for new admin users and unexpected print-script jobs.

## After you patch

Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.

- **Revoke every session and [refresh token](https://startwithidentity.com/glossary/refresh-token/)**, not just the passwords. A session issued before the patch is still valid after it.
- **Enumerate accounts created or modified during the exposure window**, including local accounts on the appliance itself, service accounts, and API tokens.
- **Remove authentication methods you did not add.** An attacker with administrative access enrols a factor so the access survives your remediation.
- **Rotate every credential the compromised system could reach**: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/).
- **Assume the device is a pivot, not a destination.** Check what it could authenticate to and treat that as in scope.

## Sources

- [NVD: CVE-2023-27350](https://nvd.nist.gov/vuln/detail/CVE-2023-27350)
- PaperCut security vulnerability log, March 2023
- CISA AA23-131A