Vulnerabilities/PaperCut/CVE-2023-27350

CVE-2023-27350: PaperCut MF/NG Improper Access Control Vulnerability

CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC

Exploitation confirmedRansomware use knownFix: Unknown

CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 21 Apr 2023

PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.

Recommended action

Apply updates per vendor instructions.

CISA due date 12 May 2023 · CWE-284

Vendor advisory ↗CISA KEV entry ↗

Am I affected?

ProductAffected versionsFixed in
NG22.0.5 (Build 63914)Unknown

No source states a fixed version. Check the vendor advisory below.

Before you patch

Restart

See vendor guidance.

Known issues

Check release notes.

Verification

Confirm installed version.

Timeline

  • 21 Apr 2023 · Added to CISA KEV
  • 12 May 2023 · CISA due date

References

Sources checked
CISA KEV30 Oct 2026, 12:10 UTC
CVE List v530 Oct 2026, 12:10 UTC
NVD30 Oct 2026, 12:10 UTC
FIRST EPSS30 Oct 2026, 12:11 UTC

Data from CISA, MITRE, NVD and FIRST. Sources and licences.