CVE-2023-27350PaperCut NG/MF auth bypass to remote code execution
What broke
PaperCut NG/MF allowed an unauthenticated caller to reach a setup/scripting surface and execute code (ZDI-CAN-18987). CVE-2023-27351 is the companion improper-authentication ID. Horizon3 published a public PoC. CISA KEV. Bloody/Bl00dy and other ransomware crews used it in April-May 2023. Fixed in 22.0.9 / 21.2.11 / 20.1.7.
Why it matters
Print management is not "facilities software." It binds to AD, stores user sync credentials, and sits on the internal network with a forgotten admin UI. An auth bypass there is an identity foothold that never touches the IdP.
What to do
- Confirm every NG/MF application and site server is past those builds. Hive/Pocket were not affected.
- Rotate the AD account PaperCut uses to sync users.
- Take port 9191/9192 off the internet. Hunt for new admin users and unexpected print-script jobs.
After you patch
Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.
- Revoke every session and refresh token, not just the passwords. A session issued before the patch is still valid after it.
- Enumerate accounts created or modified during the exposure window, including local accounts on the appliance itself, service accounts, and API tokens.
- Remove authentication methods you did not add. An attacker with administrative access enrols a factor so the access survives your remediation.
- Rotate every credential the compromised system could reach: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See secrets rotation.
- Assume the device is a pivot, not a destination. Check what it could authenticate to and treat that as in scope.
Sources
- NVD: CVE-2023-27350
- PaperCut security vulnerability log, March 2023
- CISA AA23-131A
Related identity CVEs
Related on Start with Identity
- CVEJetBrains TeamCity 2023 authentication bypass to RCE
Unauthenticated request becomes administrator, then code execution, on TeamCity On-Premises before 2023.05.4. CVSS 9.8. CISA KEV. Used by Russian state actors.
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a