CVE-2023-27350

Exploited in the Wild ✓ Confirmed 0-Day

Triaged: March 20, 2026 6 articles

VulnLookup ↗ NVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

94.26%

probability

This CVE has a 94.26% probability of being exploited in the next 30 days.

0% Top 99.9th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Attack Intelligence

CWE-284 · Improper Access Control

Exploits & PoC

horizon3ai/CVE-2023-27350

Proof of Concept Exploit for PaperCut CVE-2023-27350

imancybersecurity/CVE-2023-27350-POC

PoC CVE-2023-27350 — imancybersecurity/CVE-2023-27350-POC

adhikara13/CVE-2023-27350

Exploit for Papercut CVE-2023-27350. [+] Reverse shell [+] Mass checking

MaanVader/CVE-2023-27350-POC

A simple python script to check if a service is vulnerable

monke443/CVE-2023-27350

Unauthenticated remote command execution in Papercut service allows an attacker to execute commands due to improper access controls in the SetupComple

ThatNotEasy/CVE-2023-27350

Perfom With Massive Authentication Bypass In PaperCut MF/NG

0xB0y426/CVE-2023-27350-PoC

PoC for CVE-2023-27350

Jenderal92/CVE-2023-27350

Python 2.7

8 repos — triés par ⭐ Rechercher sur GitHub ↗

2023 Threat Landscape Year in Review: If Everything Is Critical, Nothing Is

Qualys Dec 19, 2023

Russian Hackers Suspected in Ongoing Exploitation of Unpatched PaperCut Servers

TheHackerNews

CISA Adds 3 Actively Exploited Flaws to KEV Catalog, including Critical PaperCut Bug

TheHackerNews

Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations

Qualys May 08, 2025

Researchers Uncover New Exploit for PaperCut Vulnerability That Can Bypass Detection

TheHackerNews

Bl00dy Ransomware Gang Strikes Education Sector with Critical PaperCut Vulnerability

TheHackerNews

Signal Intelligence

Confidenceⓘ

85%

EPSS 94.26%

Mentions 6

Last Seen May 08, 2025

CNA Information

Analyst Note

CVE-2023-27350 is a critical PaperCut vulnerability (CVSS 9.8) with documented evidence of active exploitation in the wild against unpatched servers. Article [5] explicitly names this CVE and describes active exploitation with new bypass techniques discovered post-disclosure, consistent with zero-day exploitation patterns in 2023.