Start with Identity
Subscribe
Identity CVE · Other

CVE-2023-27351PaperCut NG/MF improper authentication, still on CISA KEV

criticalCISA KEVActively exploited
Product: PaperCut NG/MFVendor: PaperCutCWE-287Disclosed: 2023-04-20Status: Actively exploitedNVD ↗CISA KEV ↗

What broke

PaperCut NG/MF failed authentication (CWE-287). Attackers used it as an unauthenticated foothold, then as ransomware. CISA put it on KEV. It is still there, which is why a 2023 ID belongs in a 2025-2026 identity catalog.

Why it matters

Print servers sit on the internal network, often with stored AD credentials for user sync, and they are rarely in the IAM team's inventory. Improper authentication on PaperCut is an identity incident that starts in Facilities.

What to do

  • Confirm every PaperCut node is past the 2023 patched builds. KEV items linger because appliances get forgotten.
  • Rotate any AD bind account PaperCut uses.
  • Take the admin UI off the internet.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.