CRITICAL Actively exploited Used in ransomware CWE-284
CVE-2023-27350
PaperCut MF/NG Improper Access Control Vulnerability
PaperCut·MF/NG
9.8/ 10
CVSS 3.0
Critical severity
>99.9%
EPSS exploit odds
Chance of exploitation in the next 30 days
Among the very highest of all CVEs
Listed
CISA KEV catalog
- Added
- Apr 21, 2023
- Fix due
- May 12, 2023
- Ransomware
- Known use
Timeline
- Published
- Apr 20, 2023
- Updated
- Oct 21, 2025
- First covered
- Aug 28, 2026
- Latest story
- 3 months ago
Summary
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
CWE-284Improper Access Control
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA required action
Apply updates per vendor instructions.
Affected products
- PaperCut NG22.0.5 (Build 63914)