35
CVEs
6
Critical
10
High
5
KEV
8
PoC
14
Unpatched C/H
25.7%
Patch Rate
14.6%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
10
MEDIUM
16
LOW
3
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2023-27351 | Authentication bypass in PaperCut NG and PaperCut MF print management software allows unauthenticated remote attackers to access protected functionality by exploiting flawed logic in the SecurityRequestFilter class. The flaw is confirmed actively exploited (CISA KEV) and has publicly available exploit code, with an EPSS score of 44.63% (98th percentile) indicating very high exploitation likelihood. It is commonly chained with administrative scripting features to achieve remote code execution on exposed PaperCut servers. | HIGH | 7.5 | 44.6% | 152 |
KEV
PoC
No patch
|
| CVE-2026-82078 | Remote code execution affects PaperCut MF and PaperCut NG through unsafe dynamic class loading in the database connection utilities, which instantiate JDBC driver classes from configurable driver names without validating them against an allowlist. An attacker who can control administrative system configuration parameters can force the server to load and execute arbitrary Java bytecode already present on the application classpath, running with the full privileges of the PaperCut server process. No public exploit identified at time of analysis, but the PR:H requirement and PaperCut's history of being targeted make prompt patching advisable. | CRITICAL | 9.4 | 0.5% | 132 |
KEV
PoC
|
| CVE-2026-81578 | Improper access control (CWE-305) in the PaperCut MF and PaperCut NG web management interface allows unauthenticated remote attackers to trigger backend administrative operations before access validation completes, enabling unauthorized modification of system configurations. The CVSS 4.0 vector rates this AV:N/AC:L/PR:N/UI:N with high integrity impact, indicating network-exploitable, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though PaperCut products have historically been high-value ransomware targets. | HIGH | 8.8 | 0.4% | 129 |
KEV
PoC
|
| CVE-2023-27350 | This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 100.0% | 84 |
KEV
PoC
No patch
|
| CVE-2023-39143 | PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 78.7% | 69 |
PoC
No patch
|
| CVE-2023-2533 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 29.2% | 64 |
KEV
PoC
No patch
|
| CVE-2023-4568 | PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 3.6% | 52 |
PoC
No patch
|
| CVE-2023-2508 | The `PaperCutNG Mobility Print` version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attack on an instance administrator to configure the clients host (in the "configure. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.2% | 52 |
PoC
No patch
|
| CVE-2019-8948 | PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 3.9% | 49 |
No patch
|
| CVE-2019-12135 | An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 2.5% | 49 |
No patch
|
| CVE-2024-1222 | This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 64.0% | 49 |
No patch
|
| CVE-2024-3037 | An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 7.8 | 0.4% | 39 |
No patch
|
| CVE-2024-4712 | An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 7.8 | 0.4% | 39 |
No patch
|
| CVE-2024-8404 | An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 7.8 | 0.4% | 39 |
No patch
|
| CVE-2014-2657 | Unspecified vulnerability in the print release functionality in PaperCut MF before 14.1 (Build 26983) has unknown impact and remote vectors, related to embedded MFPs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 7.5 | 0.2% | 38 |
No patch
|