Old CVEs Still Being Exploited: CVE-2023-27351, PaperCut NG/MF, Still Active in 2026

CVE Summary

Field	Details
CVE ID / CVSS Score	CVE-2023-27351, CVSS 8.2 (High)
Affected Product / Vendor	PaperCut NG and PaperCut MF, PaperCut Software
Vulnerability Class / CWE	Improper Authentication, CWE-287
Original Disclosure Date	April 20, 2023 (patched March 8, 2023)
Years Since Disclosure	Approximately 3 years
Current Exploitation Status	Actively exploited, ransomware-linked. Added to CISA's Known Exploited Vulnerabilities catalog on April 20, 2026.
Associated Threat Actors	Lace Tempest (Cl0p ransomware affiliate); Bl00dy ransomware group

Sourcing and Methodology

Two distinct kinds of sourcing support this post. The original disclosure and patch history come from PaperCut's own security advisory and contemporaneous 2023 reporting, which documented the patch timeline, the initial wave of exploitation, and Shodan-based counts of internet-exposed PaperCut servers at the time.

Confirmation that exploitation is still happening now, rather than merely having happened once in 2023, comes from CISA's own Known Exploited Vulnerabilities catalog, which added CVE-2023-27351 specifically on April 20, 2026 with a federal remediation deadline of May 4, 2026, citing evidence of active exploitation. Threat actor attribution for the exploitation history is supported by contemporaneous reporting without relying on vendor-specific naming in this post. This post treats the 2023 sources as establishing history and baseline severity, and the 2026 CISA catalog addition as the evidence that this is a live, current threat rather than a historical footnote.

Introduction

CVE-2023-27351 is three years old. It was patched in March 2023, publicly disclosed in April 2023, and by most measures should have faded into the long list of fixed, forgotten vulnerabilities that security teams no longer think about. Instead, CISA added it to its Known Exploited Vulnerabilities catalog on April 20, 2026, tying its exploitation directly to a Cl0p ransomware affiliate and confirming that unpatched PaperCut servers are still being actively targeted today. Why hasn't a three-year-old, fully patched authentication bypass in print management software died out yet? The rest of this post answers that question.

Original Disclosure Context

CVE-2023-27351 was reported to PaperCut and patched on March 8, 2023, alongside a related and more severe flaw, CVE-2023-27350, in versions 20.1.7, 21.2.11, and 22.0.9. CVE-2023-27351 was publicly disclosed on April 20, 2023. The related CVE-2023-27350 received significant attention at the time, with CISA adding it to its Known Exploited Vulnerabilities catalog within days, on April 24, 2023, while contemporaneous advisories largely focused on its higher CVSS score of 9.8 and remote code execution impact.

CVE-2023-27351 received comparatively less attention at the time. PaperCut's own advisory stated there was no evidence this specific flaw was being exploited, distinguishing it from CVE-2023-27350, for which active exploitation was confirmed almost immediately. That distinction shaped how the security community treated the two CVEs for years afterward, with CVE-2023-27350 receiving the bulk of patching urgency and CVE-2023-27351 often treated as the less pressing companion issue.

Why This Vulnerability Persists

Several concrete factors explain why a three-year-old, fully patched vulnerability is still worth a CISA catalog entry in 2026.

Unauthenticated, low-complexity exploitation. No credentials, no user interaction, and no prior access are required. A single crafted HTTP request against the SecurityRequestFilter class is sufficient, which keeps the cost of weaponizing this flaw at scale extremely low for any attacker who finds an unpatched instance.

Mature public exploit code. Proof-of-concept tooling combining this flaw with CVE-2023-27350 into a single authentication-bypass-to-RCE chain has circulated publicly since 2023, meaning exploitation requires no original research or custom development on an attacker's part today.

Infrastructure that is not top-of-mind for patching. Print management software is rarely treated as a high-priority system by IT and security teams, who tend to focus patch cycles on identity providers, email servers, and internet-facing web applications. A print server being internet-reachable at all is frequently the result of an old firewall exception nobody has revisited, rather than a deliberate design decision, which lets vulnerable instances persist quietly for years.

A large exposed population that shrank but never disappeared. Shodan scans conducted shortly after the April 2023 disclosure found roughly 1,700 internet-exposed PaperCut servers. A later independently corroborated scan found a count of around 800. That pattern, a sharp initial drop followed by a long tail that never reaches zero, is exactly the kind of residual exposed population that keeps an old CVE exploitable years after most organizations have patched. No updated, current 2026 scan count has been publicly published for this specific CVE, so this post does not claim a precise current number, only the well-documented historical trend.

Low visibility of the affected software itself. PaperCut is deployed widely across education, government, and enterprise environments, often by administrative or facilities staff rather than core IT security teams, which increases the chance that an organization does not realize it is still running an old, unpatched version at all.

Current Exploitation Activity

The concrete, current evidence of ongoing exploitation is CISA's April 20, 2026 addition of CVE-2023-27351 to its Known Exploited Vulnerabilities catalog, with a remediation deadline of May 4, 2026 for federal civilian agencies. This addition came alongside seven other vulnerabilities added to the catalog on the same date, reflecting a broader April 2026 pattern of CISA re-anchoring attention on long-standing, still-exploited issues across multiple vendors, not a PaperCut-specific event in isolation. CISA's catalog entry attributes exploitation of CVE-2023-27351 to the same threat actor and general campaign window, April 2023 onward, that was already known for CVE-2023-27350 and CVE-2023-27351's sibling exploitation, rather than describing a distinct new 2026 campaign. In effect, the 2026 catalog addition functions as a formal, delayed confirmation that the CVE-2023-27351 exploitation many suspected in 2023 has now been established as fact, and that the underlying exposure has not gone away.

Threat Actor Attribution

Contemporaneous reporting associated PaperCut exploitation in April 2023 with Lace Tempest, a threat actor associated with the Cl0p ransomware affiliate ecosystem, and with Cl0p and LockBit ransomware activity. Separately documented activity also tied the Bl00dy ransomware group to exploitation of vulnerable PaperCut servers in the same general timeframe, with observed targeting concentrated in the education sector. Reporting on the broader wave of PaperCut-targeted intrusions also associated the activity with the TrueBot and DiceLoader malware families and with Cobalt Strike beacon deployment.

Exploitation Technique and Attack Chain

The technique attackers use against CVE-2023-27351 has not meaningfully changed since 2023. It remains a single crafted HTTP request against the SecurityRequestFilter class that causes the PaperCut Application Server to treat an unauthenticated request as though it originated from a valid, logged-in session, exposing internal user account data including names, email addresses, office and department fields, card numbers, and hashed passwords for internally managed accounts. What has changed is how this flaw is used once access is gained: documented 2023 campaigns chained it with CVE-2023-27350, a separate improper access control vulnerability in PaperCut's SetupCompleted class, to escalate from authentication bypass into full remote code execution on the Application Server, which was then used as the launch point for lateral movement and ransomware deployment. There is no indication that attackers have needed to adapt or automate this technique further since 2023, since public tooling that already combines both CVEs into a single exploitation chain has been available throughout this vulnerability's exploitation history.

Affected Versions and Patch Status

CVE-2023-27351 affects PaperCut NG and PaperCut MF version 15.0 and later, across all supported operating system platforms, in any release prior to the fix. PaperCut resolved the issue in versions 20.1.7, 21.2.11, and 22.0.9, released March 8, 2023. Shodan-based exposure scans found roughly 1,700 internet-facing PaperCut instances shortly after the April 2023 disclosure, with a later independently corroborated scan finding around 800. No current, updated exposure count specific to 2026 has been publicly published, so the still-vulnerable population today cannot be stated precisely, though CISA's decision to add this CVE to its catalog three years after disclosure is itself strong evidence that unpatched instances remain reachable.

MITRE ATT&CK Mapping

No authoritative technique-level mapping specific to CVE-2023-27351 was identified for this post. CISA's Known Exploited Vulnerabilities catalog confirms active exploitation but does not natively publish ATT&CK technique mappings for each CVE. Because this vulnerability is an authentication bypass and information-disclosure flaw and does not itself provide code execution or privilege escalation, unsupported mappings are not assigned here:

Tactic	Technique	ID
Initial Access	Unavailable. No confirmed technique-level mapping specific to this CVE was identified.	Unavailable
Execution	Unavailable. This CVE does not itself provide code execution, and no confirmed technique-level mapping specific to this CVE was identified.	Unavailable
Persistence	Unavailable. No confirmed technique-level mapping specific to this CVE was identified.	Unavailable
Privilege Escalation	Unavailable. This CVE does not itself provide privilege escalation, and no confirmed technique-level mapping specific to this CVE was identified.	Unavailable
Defense Evasion	Unavailable. No confirmed technique-level mapping specific to this CVE was identified.	Unavailable
Command and Control	Unavailable. No confirmed technique-level mapping specific to this CVE was identified.	Unavailable

Notable Recent Incidents

The clearest recent, dated evidence tying this CVE to real-world impact is CISA's own April 20, 2026 Known Exploited Vulnerabilities catalog addition, with a remediation deadline of May 4, 2026, which by definition requires evidence of active exploitation to trigger. The underlying incidents that this catalog addition formally confirms trace back to April 2023, when Lace Tempest's Cl0p and LockBit ransomware campaign and the separately documented Bl00dy ransomware campaign against education sector PaperCut servers both occurred. No additional, separately dated 2026 breach disclosures specifically naming CVE-2023-27351 as the initial access vector were identified for this post; the 2026 development is the formal confirmation itself, not a newly reported incident.

Risk Context for Organizations

This vulnerability remains operationally relevant today because the organizations most likely to still be exposed are exactly the kind least likely to have prioritized patching it: education institutions and mid-sized enterprises running PaperCut as a background utility rather than a monitored, security-critical system, often on infrastructure that has not been reviewed since its initial installation years ago. Any organization running PaperCut NG or MF that has not confirmed its version explicitly, rather than assuming a past patch cycle covered it, should treat this as a live risk. The three-year gap between patch availability and formal confirmation of ongoing exploitation is itself the risk signal: a "no known exploitation" status at disclosure time is not a permanent guarantee, and organizations that deprioritized this CVE in 2023 on that basis should revisit that decision now.

Detection and Mitigation Considerations

Organizations should first confirm every PaperCut NG or MF instance is running version 20.1.7, 21.2.11, 22.0.9, or later, checked directly rather than assumed. Where immediate patching is not possible, restricting the PaperCut Application Server's web management interface to trusted internal networks, rather than leaving it internet-facing, removes the exposure that every documented exploitation campaign against this CVE has depended on. Application Server logs should be reviewed for authentication-protected requests that succeeded without a corresponding valid login event, which is the core signature of this bypass. Given the documented association with Cobalt Strike, TrueBot, and DiceLoader, endpoint detection should also watch for those specific indicators on any host running PaperCut. Organizations should treat internally managed PaperCut account passwords as potentially exposed if a vulnerable version was ever internet-facing, and rotate them as a precaution even after patching.

Key Takeaways

• CVE-2023-27351 is an unauthenticated authentication bypass in PaperCut NG/MF, patched in March 2023, but formally confirmed by CISA as still under active exploitation as of April 2026.
• It persists due to unauthenticated, low-complexity exploitation, mature public exploit tooling, low administrative visibility into print management infrastructure, and a residual internet-exposed population that shrank but never fully disappeared.
• Confirmed threat actors include Lace Tempest, a Cl0p ransomware affiliate, and the Bl00dy ransomware group, both tied to April 2023 campaigns that CISA's 2026 catalog addition now formally attributes to this specific CVE.
• The exploitation technique has not changed since 2023, and is most dangerous when chained with the related CVE-2023-27350 to achieve full remote code execution.
• Organizations should verify patch status directly, restrict internet exposure of the PaperCut Application Server, and treat a vendor's initial "no evidence of exploitation" statement as provisional rather than final.

Conclusion

CVE-2023-27351 is not a special case. It is a fairly ordinary example of a pattern that repeats across the industry: a vulnerability gets patched, receives moderate attention, and is assumed to be resolved because its more severe sibling absorbed most of the coverage. Three years later, formal confirmation arrives that it was quietly exploited the entire time. Well-known, well-patched vulnerabilities like this one often remain more dangerous in practice than newer, unpatched zero-days, precisely because defenders stop looking for them, treating yesterday's disclosure as yesterday's problem. The organizations still exposed to CVE-2023-27351 today are not running some newly discovered flaw; they are running software they patched against everything except the one thing nobody double-checked.