CVE-2023-27351Vulnerability
PaperCut NG/MF Improper Authentication Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 15 days ago
CISA KEVAdded 20 Apr 2026
Fix due 4 May 2026
Used by ransomware: knownCISA KEV catalogue
Fix due 4 May 2026
Used by ransomware: knownCISA KEV catalogue
EPSS78.1%
higher than 99% of CVEsFIRST EPSS, as of 22 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 22 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)“…t an attractive target for APTs and ransomware gangs, as proven by several vulnerabilities previously exploited in the wild (such as CVE-2023-27351 and CVE-2023-27350).”
-
Critical Vulnerabilities in PaperCut Print Management Software“These threats have been tagged by the Zero Day Initiative as ZDI-CAN-19226 (CVE-2023-27351) and ZDI-CAN-18987 (CVE-2023-27350).”
Indicators reported together
named in the same reports- hxxp://upd488.windowservicecemter[.]com/download/setup.msiin 1 report
- upd488.windowservicecemter[.]comin 1 report
- f9947c5763542b31…42641983aabbin 1 report
- gmx[.]comin 1 report
- windowservicecemter[.]comin 1 report
- c0f8aeeb2d11c6e7…8738b6cc4125in 1 report
- anydeskupdate[.]comin 1 report
- anydeskupdates[.]comin 1 report
- netviewremote[.]comin 1 report
- updateservicecenter[.]comin 1 report
- windowcsupdates[.]comin 1 report
- windowservicecentar[.]comin 1 report
- windowservicecenter[.]comin 1 report
- winserverupdates[.]comin 1 report
- hxxp://50.19.48[.]59:82/me1.batin 1 report
- 50.19.48[.]59in 1 report
Copy these 16 indicators · defanged
Also named with it: CVE-2023-27350, CVE-2026-81578, CVE-2026-82078, CVE-2026-82077
Thanks — we review every report.