# PaperCut NG/MF improper authentication, still on CISA KEV

Source: https://startwithidentity.com/cves/cve-2023-27351/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

PaperCut NG/MF failed authentication (CWE-287). Attackers used it as an unauthenticated foothold, then as ransomware. CISA put it on KEV. It is still there, which is why a 2023 ID belongs in a 2025-2026 identity catalog.

## Why it matters

Print servers sit on the internal network, often with stored AD credentials for user sync, and they are rarely in the IAM team's inventory. Improper authentication on PaperCut is an identity incident that starts in Facilities.

## What to do

- Confirm every PaperCut node is past the 2023 patched builds. KEV items linger because appliances get forgotten.
- Rotate any AD bind account PaperCut uses.
- Take the admin UI off the internet.

## After you patch

Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.

- **Revoke every session and [refresh token](https://startwithidentity.com/glossary/refresh-token/)**, not just the passwords. A session issued before the patch is still valid after it.
- **Enumerate accounts created or modified during the exposure window**, including local accounts on the appliance itself, service accounts, and API tokens.
- **Remove authentication methods you did not add.** An attacker with administrative access enrols a factor so the access survives your remediation.
- **Rotate every credential the compromised system could reach**: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/).
- **Assume the device is a pivot, not a destination.** Check what it could authenticate to and treat that as in scope.

## Sources

- [NVD: CVE-2023-27351](https://nvd.nist.gov/vuln/detail/CVE-2023-27351)
- CISA KEV