Is CVE-2023-27351 (PaperCut NG/MF Improper Authentication) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-27351 to its Known Exploited Vulnerabilities catalogue on 20 April 2026, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.

What CISA’s KEV listing tells you about active exploitation

A KEV entry is a practical signal, not just a catalogue record. It means defenders should treat the issue as live exposure, not theoretical vulnerability hygiene, and prioritise it above routine backlog work. For exploited flaws, the operational question becomes whether the vulnerable product is present anywhere in scope, whether it is internet-facing, and whether there are compensating controls while remediation is underway.

The right first check is simple inventory truth. Confirm whether any PaperCut NG/MF instance is deployed, whether it is reachable from untrusted networks, and whether the affected authentication path is actually exposed in your environment. When a flaw is on the KEV list, the cost of uncertainty is delay, so asset confirmation and ownership should move immediately to the front of the response queue.

For this question, the most useful triage lens is exposure plus business criticality. PaperCut often sits on internal print infrastructure, but that does not make it low priority if the service is reachable across user networks, supports remote access, or is linked to other administrative functions. Read the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for exact remediation guidance and timing expectations rather than relying on secondary summaries.

Why improper authentication is especially dangerous in practice

Improper authentication is dangerous because it can turn a normal login boundary into an access bypass. If an attacker can reach the vulnerable path, they may be able to act as an authenticated user or reach administrative functions without possessing valid credentials. That changes the problem from isolated software defect to potential perimeter collapse around a trusted internal application.

For exploited authentication flaws, the immediate concern is not only initial entry but what the service can reach next. Once an attacker gets past the login control, they may enumerate users, alter configuration, harvest data, or use the compromised application as a pivot point into adjacent systems. That is why authentication bugs often require both patching and post-exposure investigation, even when no overt disruption is visible.

The mechanism matters because authentication weaknesses are frequently abused quickly after public disclosure, especially when there is clear operational value in the target. If the application is exposed to broad internal access or remote administration, the likelihood of opportunistic exploitation rises, and the blast radius can include both sensitive documents and administrative trust relationships.

What to do if patching cannot happen immediately

If remediation must wait, reduce the reachable surface first. Restrict network access to the application, limit who can reach administrative interfaces, and verify whether any temporary controls such as segmentation, VPN restriction, or host firewall rules actually block the vulnerable path rather than just the front page. Temporary mitigations are only useful if they materially cut off the exposed attack path.

Then validate whether there are signs of prior access. For an exploited authentication flaw, review authentication logs, administrative actions, configuration changes, newly created accounts, and unusual service behaviour around the time the issue became public. If the application was reachable from the internet or from a wide internal audience, assume the risk of probing and attempted exploitation is real even before evidence of compromise is found.

Use NIST Cybersecurity Framework 2.0 to frame the response as identify, protect, detect, respond, and recover, but keep the emphasis on the exploit path itself: reduce exposure, verify patch status, and preserve logs for forensics. In parallel, the CVE Program and the NIST National Vulnerability Database provide the authoritative record for the vulnerability identifier and its public tracking history.

Risk and Threat Considerations

Once a flaw is in the KEV catalogue and linked to ransomware, the risk is no longer limited to misconfiguration or instability. The practical concern is that attackers may target exposed PaperCut installations specifically to gain unauthorized access, stage follow-on activity, or use the server as part of a broader intrusion chain.

Failure mechanism: An attacker abuses the improper authentication condition to bypass the normal trust boundary around the application, then uses that access to inspect, alter, or leverage the system before defenders patch or detect the activity.

Impact: The exposure can include unauthorized access to application functions, compromise of sensitive documents or administrative controls, and a foothold for further intrusion if the server is connected to broader internal services.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Prioritises KEV-listed flaws for rapid remediation and exposure verification.
Recommendation — Prioritise KEV-listed authentication flaws for rapid remediation and exposure verification.
NIST CSF 2.0	PR.AA-05 — Authenticator Management	Authentication bypass risk centers on protecting and validating access control to the application.
	DE.CM-01 — Networks and Systems Are Monitored to Detect Potential Cybersecurity Events	Post-exploitation checks depend on monitoring for anomalous authentication and admin activity.
Recommendation — Validate and harden the affected authentication boundary before restoring normal access. Monitor for anomalous authentication and administrative actions around the exposure window.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Known exploited vulnerabilities require prompt remediation and verification of fix status.
	AU-6 — Audit Record Review, Analysis, and Reporting	Log review is needed to check for prior compromise after an exploited auth flaw.
Recommendation — Accelerate remediation and verify the vulnerable component is no longer exploitable. Review audit records for signs of unauthorized access and admin activity.

Practitioner Guidance

What to prioritise: Confirm whether any PaperCut NG/MF instance is reachable from untrusted networks, then patch or isolate the instance before spending time on broader hardening work. For a KEV-listed authentication bypass, exposure reduction and remediation outrank cosmetic control tuning.

What to verify: Check whether authentication logs, admin activity, account creation, or configuration changes show anything unusual since the vulnerability became public. If the server was exposed and you cannot prove it was untouched, treat compromise assessment as part of the fix, not an optional follow-up.

Practitioner takeaway: For KEV-listed authentication flaws, the decisive question is not whether the product is “usually internal”, it is whether the vulnerable trust boundary was reachable long enough for attackers to exploit it.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org