Article
KEV and ransomware: which entries are flagged
361 of 1739 CISA KEV entries (20.8 percent) are flagged as used in ransomware campaigns. Mail and file transfer servers lead at 38.7 percent…
Read more
Exploited vulnerability
PaperCut NG and MF authentication bypass (CVE-2023-27350)
CVE-2023-27350
CVE-2023-27350 is a flaw in PaperCut NG and PaperCut MF, print management software.
- On CISA KEV
- CVE ID
- CVE-2023-27350
- CISA KEV
- Listed
- Affected product
- PaperCut NG and PaperCut MF (Application Servers and Site Servers)
- Exploited
- Yes
- Published
- April 2023
In short
CVE-2023-27350 is a flaw in PaperCut NG and PaperCut MF, print management software. It lets an outsider skip the login and run code on the server. The FBI and CISA say it was exploited from mid-April 2023, and CISA lists it in its Known Exploited Vulnerabilities catalog.
- CVECVE-2023-27350
- ProductPaperCut PaperCut NG and PaperCut MF (Application Servers and Site Servers)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedUpgrade PaperCut · Hunt for odd child processes
What it allows
An attacker with no account can get in as an administrator and then use normal PaperCut features to run commands. The server process runs with SYSTEM or root level rights, so those commands run with the same rights. In the cases the FBI describes, attackers used the print scripting feature to install legitimate remote management software on victim systems.
Who is affected
Per the vendor, versions 15.0.0 to 19.2.7, 20.0.0 to 20.1.6, 21.0.0 to 21.2.10 and 22.0.0 to 22.0.8 are affected. Application Servers and Site Servers are impacted. The fix is in 20.1.7, 21.2.11 and 22.0.9 and later. The FBI and CISA note that education organizations held about 68 percent of exposed, but not necessarily vulnerable, US-based PaperCut servers.
The vendor says the earliest sign of suspicious activity on a customer server that may link to this flaw was on 14 April 2023, and its first customer report came on 18 April. The vendor then said it had evidence that unpatched servers were being exploited in the wild. NVD published the record in April 2023, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 21 April 2023. The KEV entry flags known use in ransomware campaigns.
In advisory AA23-131A, the FBI and CISA say malicious actors exploited the flaw from mid-April 2023. In early May 2023, according to FBI information, a group calling itself the Bl00dy Ransomware Gang tried to exploit exposed vulnerable servers against the education facilities subsector. Some of these operations led to data theft and encryption of victim systems.
Who exploits it
What to do
-
Upgrade PaperCut
The vendor recommends upgrading to 20.1.7, 21.2.11 or 22.0.9, or later. The FBI and CISA say to upgrade to the latest version.
-
Block access if you cannot patch
The FBI and CISA say to keep vulnerable servers off the internet. One option is to block all inbound traffic from external addresses to the web management portal, ports 9191 and 9192 by default.
-
Assume compromise if you patched late
The FBI and CISA especially encourage organizations that did not patch immediately to assume compromise and hunt for malicious activity.
-
Hunt for odd child processes
The advisory tells defenders to look for child processes started by the PaperCut server process pc-app.exe, and to check server settings and log files.
-
Require phishing-resistant MFA
The advisory recommends phishing-resistant multifactor authentication for all staff and all services.
Questions
What is CVE-2023-27350?
CVE-2023-27350 is an improper access control flaw in PaperCut NG and PaperCut MF. It leads to authentication bypass and remote code execution, so an attacker with no account can get in as an administrator.
Which PaperCut versions are affected?
Per the vendor, versions 15.0.0 to 19.2.7, 20.0.0 to 20.1.6, 21.0.0 to 21.2.10 and 22.0.0 to 22.0.8 are affected. The fix is in 20.1.7, 21.2.11 and 22.0.9 and later.
When was CVE-2023-27350 first exploited?
The vendor says the earliest sign of suspicious activity on a customer server was on 14 April 2023. The FBI and CISA say malicious actors exploited the flaw from mid-April 2023.
Has CVE-2023-27350 been used in ransomware?
CISA added the flaw to its Known Exploited Vulnerabilities catalog on 21 April 2023, and the entry flags known use in ransomware campaigns. The FBI and CISA report ransomware use.
In our research
- KEV and ransomware: which entries are flagged October 2026
- KEV additions 2024 to 2026 by product type October 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.