CVE-2023-27351High· 7.5▾ Abyssal⚠ Exploited in the wild0dayPoC availableThis vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the Security…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 41.3 · likelihood 15.6 · exploitation 25 · ransomware 5
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due May 4, 2026
Last analysed / modified upstream
78%
Nuclei ×1 (last check)
8.2 → 7.5
Added to the CISA catalog on Apr 20, 2026. Federal remediation due May 4, 2026. View catalog ↗
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
papercut_mf >= 15.0, < 20.1.7papercut_mf >= 21.0.0, < 21.2.11papercut_mf >= 22.0.0, < 22.0.9papercut_ng >= 15.0, < 20.1.7papercut_ng >= 21.0.0, < 21.2.11papercut_ng >= 22.0.0, < 22.0.9Upgrade past the affected range:
papercut_mf 22.0.9papercut_ng 22.0.9Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81578Critical· 9.8An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG
CVE-2026-82078Critical· 9.4PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
CVE-2023-49105Critical· 9.8An issue was discovered in ownCloud owncloud/core before 10.13.1
CVE-2022-40684Critical· 9.8An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 …
CVE-2023-35078Critical· 9.8An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
CVE-2026-42018High· 7.5JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.