PaperCut NG/MF CVE-2023-2533: 2023 CSRF Added to KEV in 2025
This 2023 CSRF needs a logged-in admin to be lured to a page, but any PaperCut server old enough to have it is also open to later, mass-exploited PaperCut bugs; find such servers and move them to a current release.
Must act: Anyone running a PaperCut NG or MF Application Server older than 22.1.1 (other than 21.2.12 or 20.1.8), and anyone on version 23 or earlier, which gets no fix for the 2026 PaperCut bugs.
Can relax: PaperCut Hive and Pocket customers (outside the NG/MF product line), and NG/MF servers already on 24.1.10, 25.0.13, 26.0.5 or later with the admin interface kept off the internet.
- Inventory every PaperCut NG/MF Application Server and record its version from the admin interface.
- Upgrade to 26.0.5, 25.0.13 or 24.1.10; servers on version 23 or earlier must move to a supported line.
- Restrict the admin web interface to trusted internal addresses and review session timeouts.