Is CVE-2023-27350 (PaperCut MF/NG Improper Access Control) being exploited in the wild?

Yes. CISA added CVE-2023-27350 to its Known Exploited Vulnerabilities catalogue on 21 April 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.

How KEV status answers the “in the wild” question

For a CVE question like this, the practical issue is not just whether a flaw exists, but whether defenders should treat it as an active exposure. CISA’s KEV listing is the strongest public signal that the vulnerability is being used in real attacks, so the answer should drive immediate prioritisation rather than routine backlog handling. For PaperCut MF/NG, that means exposure should be treated as urgent until verified otherwise.

When a vulnerability is in KEV, the operational question becomes whether the product is present anywhere in the environment, whether the affected service is internet reachable, and whether the system has already shown signs of unauthorised access. That is why exploited-vulnerability triage belongs in the same queue as containment and compromise assessment, not ordinary maintenance.

Defenders should use the vendor advisory and CISA KEV record for version-specific remediation details, but the decision point is straightforward: if the software is deployed, it needs immediate validation, prioritisation and follow-through because the exploitation question has already crossed the threshold from theoretical to real.

What this means for PaperCut MF/NG exposure

CVE-2023-27350 matters because the vulnerability is not a narrow configuration issue. The direct answer describes an improper access control flaw that enables authentication bypass and code execution in the context of the system, which means compromise can go well beyond a single user session. In practice, that kind of flaw can let an attacker move from initial access to administrative control or deeper host activity very quickly.

The first task is to confirm whether any PaperCut MF/NG instance is exposed, especially if it is reachable from the internet or sits in a segment that other systems trust. If an attacker can reach the management surface, the risk is not only exploitation of the application itself but also downstream access to print infrastructure, adjacent services and any credentials or tokens accessible from the host.

Because this is an access-control failure, defenders should assume the blast radius may be larger than the product boundary. The vulnerable component may be used as a foothold for command execution, credential collection or follow-on access inside the environment, which makes fast exposure mapping more important than debating whether a single endpoint was targeted.

What to do when patching has to wait

If remediation cannot happen immediately, the goal is to reduce attacker reach and create enough detection to see abuse early. That usually means restricting network access to the PaperCut interface, tightening administrative exposure, and watching for unusual requests, process creation or signs that the application is being used as an execution path rather than just a print service.

Where the service has already been externally reachable, assume earlier compromise is possible and investigate accordingly. Review authentication logs, administrative actions, service account behaviour and host-level telemetry for suspicious activity around the period when exploitation became public. If the product touched sensitive directories or used privileged local credentials, widen the review to those assets as well.

If there is any indication the system was abused, rotate credentials and tokens that the server could have exposed, and consider whether sessions or supporting accounts need to be invalidated. The important judgement is that waiting to see evidence of abuse before looking for it usually leaves the attacker with more time to persist.

Risk and Threat Considerations

Publicly exploited application flaws create a short decision window: they are attractive because defenders often need time to patch, while attackers only need one reachable instance and one successful bypass. Once a KEV listing exists, the question shifts from possibility to likely attacker interest, especially where the flaw enables unauthenticated access or code execution.

Failure mechanism: Improper access control allows an attacker to bypass normal authentication checks and reach functionality that should have been protected, which can then be chained into code execution, persistence or internal discovery.

Impact: The result can be full host compromise, lateral movement, credential exposure and ransomware staging, especially if the server has access to trusted administrative paths or stored secrets.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Actively exploited CVEs require prompt remediation and exception handling.
Recommendation — Prioritise and track patching for KEV-listed flaws under a formal flaw remediation process.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation is a vulnerability-management priority signal.
Recommendation — Use continuous vulnerability management to identify, prioritise and remediate exploited software quickly.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	Known exploitation changes prioritisation and risk acceptance for exposure management.
	PR.DS-05 — Data-at-rest is protected	Code execution on a server can expose stored data and secrets requiring protection.
	DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events	Exploited CVEs need monitoring for exploitation attempts and post-compromise activity.
Recommendation — Fold KEV-listed exposure into risk prioritisation and escalation decisions. Protect sensitive data and secrets on exposed systems with stronger isolation and access limits. Monitor exposed services for signs of exploitation and follow-on malicious activity.

Practitioner Guidance

What to prioritise: Treat KEV-listed exploitation as an exposure-management event, not just a patch ticket. Validate whether PaperCut MF/NG is deployed anywhere, whether it is externally reachable, and whether any instance has privileged reach into other systems.

What to verify: Confirm whether logs, EDR telemetry and application records show suspicious access, unexpected child processes, new accounts, abnormal admin actions or other signs of pre-patch compromise. If the answer is uncertain, assume the system needs compromise assessment before normal operations resume.

Decision rule: If patching is delayed, compensate by narrowing access, increasing monitoring and preparing credential rotation for any account or token the server may have touched. If compromise indicators exist, contain first, then eradicate, then restore.

Practitioner takeaway: For actively exploited CVEs, speed is important, but blast-radius assessment is what determines whether the issue is a patching problem or a broader incident.