CVE-2023-27350Vulnerability
PaperCut MF/NG Improper Access Control Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 3 independent sources · first reported by Huntress · last reported
Last reported 15 days ago
CISA KEVAdded 21 Apr 2023
Fix due 12 May 2023
Used by ransomware: knownCISA KEV catalogue
Fix due 12 May 2023
Used by ransomware: knownCISA KEV catalogue
EPSS100.0%
higher than 99% of CVEsFIRST EPSS, as of 26 Sep 2026
higher than 99% of CVEsFIRST EPSS, as of 26 Sep 2026
What the reports say
3 reports, newest first · the exact sentence from each-
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)“…get for APTs and ransomware gangs, as proven by several vulnerabilities previously exploited in the wild (such as CVE-2023-27351 and CVE-2023-27350).”
-
PaperCut NG/MF Critical Zero-Day Exploited in the Wild“PaperCut has been targeted in the past; in 2023, CVE-2023-27350 was broadly exploited in the wild by multiple threat-actor groups, including ransomware operators.”
-
Critical Vulnerabilities in PaperCut Print Management Software“These threats have been tagged by the Zero Day Initiative as ZDI-CAN-19226 (CVE-2023-27351) and ZDI-CAN-18987 (CVE-2023-27350).”
Indicators reported together
named in the same reports- hxxp://upd488.windowservicecemter[.]com/download/setup.msiin 1 report
- upd488.windowservicecemter[.]comin 1 report
- f9947c5763542b31…42641983aabbin 1 report
- gmx[.]comin 1 report
- windowservicecemter[.]comin 1 report
- c0f8aeeb2d11c6e7…8738b6cc4125in 1 report
- anydeskupdate[.]comin 1 report
- anydeskupdates[.]comin 1 report
- netviewremote[.]comin 1 report
- updateservicecenter[.]comin 1 report
- windowcsupdates[.]comin 1 report
- windowservicecentar[.]comin 1 report
- windowservicecenter[.]comin 1 report
- winserverupdates[.]comin 1 report
- hxxp://50.19.48[.]59:82/me1.batin 1 report
- 50.19.48[.]59in 1 report
Copy these 16 indicators · defanged
Also named with it: CVE-2026-81578, CVE-2026-82078, CVE-2023-27351, CVE-2026-82077
Thanks — we review every report.