Is CVE-2023-27350 (PaperCut MF/NG Improper Access Control) being exploited in the wild?

How KEV status answers the “in the wild” question

For a CVE question like this, the practical issue is not just whether a flaw exists, but whether defenders should treat it as an active exposure. CISA’s KEV listing is the strongest public signal that the vulnerability is being used in real attacks, so the answer should drive immediate prioritisation rather than routine backlog handling. For PaperCut MF/NG, that means exposure should be treated as urgent until verified otherwise.

When a vulnerability is in KEV, the operational question becomes whether the product is present anywhere in the environment, whether the affected service is internet reachable, and whether the system has already shown signs of unauthorised access. That is why exploited-vulnerability triage belongs in the same queue as containment and compromise assessment, not ordinary maintenance.

Defenders should use the vendor advisory and CISA KEV record for version-specific remediation details, but the decision point is straightforward: if the software is deployed, it needs immediate validation, prioritisation and follow-through because the exploitation question has already crossed the threshold from theoretical to real.

What this means for PaperCut MF/NG exposure

CVE-2023-27350 matters because the vulnerability is not a narrow configuration issue. The direct answer describes an improper access control flaw that enables authentication bypass and code execution in the context of the system, which means compromise can go well beyond a single user session. In practice, that kind of flaw can let an attacker move from initial access to administrative control or deeper host activity very quickly.

The first task is to confirm whether any PaperCut MF/NG instance is exposed, especially if it is reachable from the internet or sits in a segment that other systems trust. If an attacker can reach the management surface, the risk is not only exploitation of the application itself but also downstream access to print infrastructure, adjacent services and any credentials or tokens accessible from the host.

Because this is an access-control failure, defenders should assume the blast radius may be larger than the product boundary. The vulnerable component may be used as a foothold for command execution, credential collection or follow-on access inside the environment, which makes fast exposure mapping more important than debating whether a single endpoint was targeted.

What to do when patching has to wait

If remediation cannot happen immediately, the goal is to reduce attacker reach and create enough detection to see abuse early. That usually means restricting network access to the PaperCut interface, tightening administrative exposure, and watching for unusual requests, process creation or signs that the application is being used as an execution path rather than just a print service.

Where the service has already been externally reachable, assume earlier compromise is possible and investigate accordingly. Review authentication logs, administrative actions, service account behaviour and host-level telemetry for suspicious activity around the period when exploitation became public. If the product touched sensitive directories or used privileged local credentials, widen the review to those assets as well.

If there is any indication the system was abused, rotate credentials and tokens that the server could have exposed, and consider whether sessions or supporting accounts need to be invalidated. The important judgement is that waiting to see evidence of abuse before looking for it usually leaves the attacker with more time to persist.

Risk and Threat Considerations

Publicly exploited application flaws create a short decision window: they are attractive because defenders often need time to patch, while attackers only need one reachable instance and one successful bypass. Once a KEV listing exists, the question shifts from possibility to likely attacker interest, especially where the flaw enables unauthenticated access or code execution.

Failure mechanism: Improper access control allows an attacker to bypass normal authentication checks and reach functionality that should have been protected, which can then be chained into code execution, persistence or internal discovery.

Impact: The result can be full host compromise, lateral movement, credential exposure and ransomware staging, especially if the server has access to trusted administrative paths or stored secrets.

Practitioner Guidance

What to prioritise: Treat KEV-listed exploitation as an exposure-management event, not just a patch ticket. Validate whether PaperCut MF/NG is deployed anywhere, whether it is externally reachable, and whether any instance has privileged reach into other systems.

What to verify: Confirm whether logs, EDR telemetry and application records show suspicious access, unexpected child processes, new accounts, abnormal admin actions or other signs of pre-patch compromise. If the answer is uncertain, assume the system needs compromise assessment before normal operations resume.

Decision rule: If patching is delayed, compensate by narrowing access, increasing monitoring and preparing credential rotation for any account or token the server may have touched. If compromise indicators exist, contain first, then eradicate, then restore.

Practitioner takeaway: For actively exploited CVEs, speed is important, but blast-radius assessment is what determines whether the issue is a patching problem or a broader incident.

Related resources from NHI Mgmt Group

• Guide: Zero-Day and Exploited Vulnerabilities Guide
• CVE-2023-27350 (PaperCut MF/NG Improper Access Control)
• Is CVE-2023-2533 (PaperCut NG/MF Cross-Site Request Forgery (CSRF)) being exploited in the wild?
• Is CVE-2023-7028 (GitLab Community and Enterprise Editions Improper Access Control) being exploited in the wild?
• Is CVE-2023-23752 (Joomla! Improper Access Control) being exploited in the wild?