PaperCut NG/MF CVE-2023-2533: 2023 CSRF Added to KEV in 2025

What to do

1. Inventory every PaperCut NG/MF Application Server and record its version from the admin interface.
2. Upgrade to 26.0.5, 25.0.13 or 24.1.10; servers on version 23 or earlier must move to a supported line.
3. Restrict the admin web interface to trusted internal addresses and review session timeouts.
4. Have admins use a dedicated browser profile for the PaperCut console and log out after use.
5. Check print script settings and printer scripts for changes nobody made on purpose.

How to check if you are affected or compromised

• In the admin interface, confirm print scripting is set as you expect, the print script sandbox is still enabled, and no printer carries a script you did not write.
• Review the PaperCut application log for configuration or security-setting changes made at times no admin was working.
• Search web server or proxy logs for admin POST requests whose Referer or Origin header points to an outside site.
• Look for the PaperCut Application Server process starting shells or scripting engines.

What happened#

On June 8, 2023, PaperCut released NG/MF 22.1.1 and a security bulletin covering CVE-2023-2533. It is a cross-site request forgery (CSRF) flaw in the Application Server's web interface. The bulletin says that "under specific conditions" it could let an attacker "alter security settings or execute arbitrary code," if an admin with a current login session is tricked into opening a crafted link. Carlos Bello of Fluid Attacks reported it on May 4, 2023.

Fluid Attacks' advisory, published June 13 with a working proof-of-concept page, shows the path to code execution. The forged requests enable print scripting, disable the print script sandbox and attach a script to a printer. The script runs when anyone prints to that printer. Fluid Attacks, the CNA, scores it CVSS 3.1 8.4 on the CVE record. PaperCut gives 7.9 and NVD gives 8.8.

Two years later, on July 28, 2025, CISA added the CVE to the KEV catalog "based on evidence of active exploitation," alongside two Cisco ISE flaws. Federal agencies had until August 18, 2025.

Who is affected#

PaperCut NG and MF Application Servers on every platform before 22.1.1, except the fixed 21.2.12 and 20.1.8 builds. PaperCut lists Site Servers as not impacted. SecurityWeek cited Shadowserver data showing roughly 1,000 PaperCut instances reachable from the internet, without knowing how many are vulnerable.

Do you really need to act?#

Why this bug, and why in 2025? Nobody has said publicly. CISA shared no details. SecurityWeek and The Hacker News both reported that how it was exploited was not known. As of Oct 23, 2026, we found no vendor or researcher report tying CVE-2023-2533 to a specific campaign. The Hacker News notes that PaperCut servers were already a favored target, abused by Iranian state actors, the Bl00dy group and the Cl0p and LockBit ransomware operators.

On its own, this bug needs a logged-in admin to be lured to a page, so it is not a mass-exploitation risk. The real issue is what an old server implies. Every build older than 24.1.10 is open to the unauthenticated chain that includes CVE-2026-82078, which CISA listed on August 31, 2026. CISA also listed CVE-2023-27351, another 2023 PaperCut authentication bypass, in April 2026. PaperCut's August 2026 bulletin fixes that chain only in 24.1.10, 25.0.13 and 26.0.5, and says there are no patches for version 23 or earlier. So the verdict is check exposure, with an upgrade for anything old.

What to do now#

1. Record each Application Server's version and build from the admin web interface.
2. Upgrade to 26.0.5, 25.0.13 or 24.1.10. Servers on version 23 or earlier must move to a supported line.
3. Restrict the admin interface to trusted internal addresses and review session timeouts, as The Hacker News suggests.
4. Have admins use a separate browser profile for the PaperCut console and log out when done.

How to tell if you were hit#

• In the admin interface, check that print scripting is set as you expect, the print script sandbox is still on, and no printer carries a script you did not write.
• Review the application log for configuration or security changes made when no admin was working.
• Search proxy or web logs for admin POST requests whose Referer or Origin points to an outside site.
• Watch for the PaperCut server process starting shells or scripting engines.

Timeline#

• May 4, 2023 — Fluid Attacks reports the flaw to PaperCut.
• Jun 8, 2023 — PaperCut releases 22.1.1 and its bulletin.
• Jun 13, 2023 — Fluid Attacks publishes its advisory.
• Jul 28, 2025 — CISA adds the CVE to KEV.
• Aug 18, 2025 — Federal remediation deadline.
• Aug 31, 2026 — CISA adds the 2026 PaperCut chain to KEV.

Vulnerability records

• CVE-2023-2533 · KEV 2025-07-28 · A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. PaperCut — Security Bulletin: June 2023 papercut.com
2. PaperCut — URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026) papercut.com
3. Fluid Attacks — Arcangel: PaperCut MF/NG 22.0.10 remote code execution via CSRF fluidattacks.com
4. CVE record — CVE-2023-2533 cve.org
5. NVD — CVE-2023-2533 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2023-2533 cisa.gov
7. CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Jul 28, 2025) cisa.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2023-27351 cisa.gov
9. CVE record — CVE-2026-82078 cve.org

Coverage and analysis

1. SecurityWeek — Organizations Warned of Exploited PaperCut Flaw securityweek.com
2. The Hacker News — CISA Adds PaperCut NG/MF CSRF Vulnerability to KEV Catalog thehackernews.com