Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-27351

CVE-2023-27351HIGH

PaperCut NG/MF

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .7805   99.6   YES

AFFECTED
  Product  Versions                Fixed
  NG       22.0.5 (Build 63914) –  —

TIMELINE
  Feb 28  Reserved by zdi
  Apr 20  Published (CNA: zdi)
  Apr 20  Added to CISA KEV, remediation due 2026-05-04
  Oct 1   RESCORED — CVE-2023-27351 (PaperCut NG). CVSS 8.2 → 7.5 (NVD).

CWE-287 · CNA: zdi · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due May 4, 2026

Description

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
February 28, 2023	Reserved	Reserved by zdi
April 20, 2023	Published	Published (CNA: zdi)
April 20, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-05-04
October 1, 2026	RESCORED	RESCORED — CVE-2023-27351 (PaperCut NG). CVSS 8.2 → 7.5 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
PaperCut	NG	—	22.0.5 (Build 63914)	—

Weaknesses

CWE-287

References (3)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27351 [US Government Resource]
https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 [Vendor Advisory]
https://www.zerodayinitiative.com/advisories/ZDI-23-232/ [Third Party Advisory, VDB Entry]

Authoritative record: CVE-2023-27351 at cve.org

Vendors: papercut

Weaknesses: CWE-287

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-27351 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.