Page generated: 09 Nov 2026, 08:38 UTC
← Dashboard

CVE-2023-27351

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from…

Read full description
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
CVSS 8.2 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
2.3/10
REALITY · THREAT PRIORITY
8.6/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 8.2: +1.23
  • Fresh EPSS: 78.05%: +0.39

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 12 documents and public datasets.

Hype components

Headline sample (25%)
80/100
Press, 30 days (60%)
5/100
Grounded branding (15%)
0/100
HYPE TOTAL23/100

Sources and documents

watchTowr Labs
Press · 09 Oct 2026, 17:31 · Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
Help Net Security
Press · 27 Aug 2026, 07:00 · PaperCut NG/MF vulnerabilities exploited in zero-day attacks - Help Net Security
The Hacker News
Press · 21 Apr 2026, 07:00 · CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines - The Hacker News
LinkedIn
Press · 21 Apr 2026, 07:00 · CISA Warns of Actively Exploited Cisco SD-WAN Flaw - Orders Urgent Federal Patching - LinkedIn
Help Net Security
Press · 21 Apr 2026, 07:00 · CISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133) - Help Net Security
See all 12 source documents
BleepingComputer
Press · 28 Jul 2025, 07:00 · CISA flags PaperCut RCE bug as exploited in attacks, patch now - BleepingComputer
SentinelOne
Press · 14 May 2024, 07:00 · PaperCut Vulnerability: Unpatched Servers Exploited in the Wild - SentinelOne
Rapid7
Press · 17 May 2023, 07:00 · CVE-2023-27350: Ongoing Exploitation of PaperCut Remote Code Execution Vulnerability - Rapid7
SecurityWeek
Press · 27 Apr 2023, 07:00 · Microsoft: Cl0p Ransomware Exploited PaperCut Vulnerabilities Since April 13 - SecurityWeek
The Record from Recorded Future News
Press · 27 Apr 2023, 07:00 · Hackers use PaperCut printer vulnerability to spread Clop ransomware - The Record from Recorded Future News
Help Net Security
Press · 25 Apr 2023, 07:00 · PoC exploit for abused PaperCut flaw is now public (CVE-2023-27350) - Help Net Security
Security Affairs
Press · 24 Apr 2023, 07:00 · Experts released PoC Exploit code for actively exploited PaperCut flaw - Security Affairs

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 2.3 · reality 8.6 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 8.2; EPSS 78.1%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:51.863837+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
20 Apr 2023, 00:00
First press mention
24 Apr 2023, 07:00
Added to the CISA KEV catalog
20 Apr 2026, 00:00
Latest press mention
09 Oct 2026, 17:31
Score calculated
05 Nov 2026, 13:58