HOMEVULNERABILITIESCVE-2023-27351
UNKNOWNCISA KEVIN THE WILD

CVE-2023-27351

Published: April 11, 2026

Official Description

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.

NVD Source

Technical Analysis

CVE-2023-27351 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2023-27351 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.

Exploit & PoC Resources

ACTIVE EXPLOITATIONConfirmed exploitation in the wild
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2023-27351

CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines
The Hacker News· Apr 21, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including three flaws impacting Cisco Catalyst SD-WAN Manager, citing evidence of active exploitation. The list of vulnerabilities is as follows - CVE-2023-27351 (CVSS score: 8.2) - An improper authentication vulnerability in PaperCut [xlite_meta score:50 src:The Hacker News xlite_fp:49ebef7f13851d918b5eb2c21151c00909be6f3e6e94c674825443d74d4d5471]

CISA Adds Eight Known Exploited Vulnerabilities to Catalog
CISA Alerts· Apr 20, 2026

CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability CVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability CVE-2025-2749 Kentico Xperience Path Traversal Vulnerability CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability CVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability CVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability CVE-2026-20133 Cisco Catalyst SD-WAN Ma [xlite_meta score:63 src:CISA Alerts xlite_fp:0b55e79970c47e4ece69ce1dd3660bb43f47c536c063390ae3b0b0034a186fa0]

Quick Facts

CVE IDCVE-2023-27351
Severity—
CISA KEVYES — Active Exploitation
ExploitIN THE WILD
PublishedApr 11, 2026

Known Threat Actors

wa
financial
B0
financial
core
financial
J
financial

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2023-27351 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
  • !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
  • !Active exploitation confirmed — treat as P1
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2023-27351·NVD