---
title: "PaperCut NG/MF CVE-2023-2533: 2023 CSRF Added to KEV in 2025"
url: https://erroneo.us/security/briefs/papercut-ng-mf-cve-2023-2533-csrf-kev/
description: "A CSRF in PaperCut NG/MF before 22.1.1 can turn an admin's click into code execution. Patched in 2023, in KEV since July 2025. Find old servers and upgrade."
type: security-brief
section: "Security Digest"
date_published: 2023-06-08
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-2533"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# PaperCut NG/MF CVE-2023-2533: 2023 CSRF Added to KEV in 2025

**Verdict: Check exposure.** This 2023 CSRF needs a logged-in admin to be lured to a page, but any PaperCut server old enough to have it is also open to later, mass-exploited PaperCut bugs; find such servers and move them to a current release.

- **Who must act:** Anyone running a PaperCut NG or MF Application Server older than 22.1.1 (other than 21.2.12 or 20.1.8), and anyone on version 23 or earlier, which gets no fix for the 2026 PaperCut bugs.
- **Who can relax:** PaperCut Hive and Pocket customers (outside the NG/MF product line), and NG/MF servers already on 24.1.10, 25.0.13, 26.0.5 or later with the admin interface kept off the internet.
- **Affected:** PaperCut NG and MF Application Server, all versions before 22.1.1, on all platforms, except 21.2.12 and 20.1.8; Site Servers are not impacted, per PaperCut
- **Fixed:** PaperCut NG/MF 22.1.1 or later, 21.2.12, 20.1.8 (June 2023); Current releases: 26.0.5, 25.0.13 or 24.1.10, required for the 2026 bugs
- **CVEs:** CVE-2023-2533
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every PaperCut NG/MF Application Server and record its version from the admin interface.
2. Upgrade to 26.0.5, 25.0.13 or 24.1.10; servers on version 23 or earlier must move to a supported line.
3. Restrict the admin web interface to trusted internal addresses and review session timeouts.
4. Have admins use a dedicated browser profile for the PaperCut console and log out after use.
5. Check print script settings and printer scripts for changes nobody made on purpose.

### How to check if you are affected

- In the admin interface, confirm print scripting is set as you expect, the print script sandbox is still enabled, and no printer carries a script you did not write.
- Review the PaperCut application log for configuration or security-setting changes made at times no admin was working.
- Search web server or proxy logs for admin POST requests whose Referer or Origin header points to an outside site.
- Look for the PaperCut Application Server process starting shells or scripting engines.

## What happened

On June 8, 2023, PaperCut released NG/MF 22.1.1 and a [security bulletin](https://www.papercut.com/kb/Main/SecurityBulletinJune2023) covering CVE-2023-2533. It is a cross-site request forgery (CSRF) flaw in the Application Server's web interface. The bulletin says that "under specific conditions" it could let an attacker "alter security settings or execute arbitrary code," if an admin with a current login session is tricked into opening a crafted link. Carlos Bello of Fluid Attacks reported it on May 4, 2023.

[Fluid Attacks' advisory](https://fluidattacks.com/advisories/arcangel/), published June 13 with a working proof-of-concept page, shows the path to code execution. The forged requests enable print scripting, disable the print script sandbox and attach a script to a printer. The script runs when anyone prints to that printer. Fluid Attacks, the CNA, scores it CVSS 3.1 8.4 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-2533). PaperCut gives 7.9 and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-2533) gives 8.8.

Two years later, on July 28, 2025, CISA [added](https://www.cisa.gov/news-events/alerts/2025/07/28/cisa-adds-three-known-exploited-vulnerabilities-catalog) the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533) "based on evidence of active exploitation," alongside two Cisco ISE flaws. Federal agencies had until August 18, 2025.

## Who is affected

PaperCut NG and MF Application Servers on every platform before 22.1.1, except the fixed 21.2.12 and 20.1.8 builds. PaperCut lists Site Servers as not impacted. [SecurityWeek](https://www.securityweek.com/organizations-warned-of-exploited-papercut-flaw/) cited Shadowserver data showing roughly 1,000 PaperCut instances reachable from the internet, without knowing how many are vulnerable.

## Do you really need to act?

Why this bug, and why in 2025? Nobody has said publicly. CISA shared no details. SecurityWeek and [The Hacker News](https://thehackernews.com/2025/07/cisa-adds-papercut-ngmf-csrf.html) both reported that how it was exploited was not known. As of Oct 23, 2026, we found no vendor or researcher report tying CVE-2023-2533 to a specific campaign. The Hacker News notes that PaperCut servers were already a favored target, abused by Iranian state actors, the Bl00dy group and the Cl0p and LockBit ransomware operators.

On its own, this bug needs a logged-in admin to be lured to a page, so it is not a mass-exploitation risk. The real issue is what an old server implies. Every build older than 24.1.10 is open to the unauthenticated chain that includes [CVE-2026-82078](https://www.cve.org/CVERecord?id=CVE-2026-82078), which CISA listed on August 31, 2026. CISA also listed [CVE-2023-27351](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27351), another 2023 PaperCut authentication bypass, in April 2026. PaperCut's [August 2026 bulletin](https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/) fixes that chain only in 24.1.10, 25.0.13 and 26.0.5, and says there are no patches for version 23 or earlier. So the verdict is check exposure, with an upgrade for anything old.

## What to do now

1. Record each Application Server's version and build from the admin web interface.
2. Upgrade to 26.0.5, 25.0.13 or 24.1.10. Servers on version 23 or earlier must move to a supported line.
3. Restrict the admin interface to trusted internal addresses and review session timeouts, as The Hacker News suggests.
4. Have admins use a separate browser profile for the PaperCut console and log out when done.

## How to tell if you were hit

- In the admin interface, check that print scripting is set as you expect, the print script sandbox is still on, and no printer carries a script you did not write.
- Review the application log for configuration or security changes made when no admin was working.
- Search proxy or web logs for admin POST requests whose `Referer` or `Origin` points to an outside site.
- Watch for the PaperCut server process starting shells or scripting engines.

## Timeline

- May 4, 2023 — Fluid Attacks reports the flaw to PaperCut.
- Jun 8, 2023 — PaperCut releases 22.1.1 and its bulletin.
- Jun 13, 2023 — Fluid Attacks publishes its advisory.
- Jul 28, 2025 — CISA adds the CVE to KEV.
- Aug 18, 2025 — Federal remediation deadline.
- Aug 31, 2026 — CISA adds the 2026 PaperCut chain to KEV.

## Sources

1. [PaperCut — Security Bulletin: June 2023](https://www.papercut.com/kb/Main/SecurityBulletinJune2023)
2. [PaperCut — URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)](https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/)
3. [Fluid Attacks — Arcangel: PaperCut MF/NG 22.0.10 remote code execution via CSRF](https://fluidattacks.com/advisories/arcangel/)
4. [CVE record — CVE-2023-2533](https://www.cve.org/CVERecord?id=CVE-2023-2533)
5. [NVD — CVE-2023-2533](https://nvd.nist.gov/vuln/detail/CVE-2023-2533)
6. [CISA — Known Exploited Vulnerabilities: CVE-2023-2533](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533)
7. [CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Jul 28, 2025)](https://www.cisa.gov/news-events/alerts/2025/07/28/cisa-adds-three-known-exploited-vulnerabilities-catalog)
8. [CISA — Known Exploited Vulnerabilities: CVE-2023-27351](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27351)
9. [CVE record — CVE-2026-82078](https://www.cve.org/CVERecord?id=CVE-2026-82078)
10. [SecurityWeek — Organizations Warned of Exploited PaperCut Flaw](https://www.securityweek.com/organizations-warned-of-exploited-papercut-flaw/)
11. [The Hacker News — CISA Adds PaperCut NG/MF CSRF Vulnerability to KEV Catalog](https://thehackernews.com/2025/07/cisa-adds-papercut-ngmf-csrf.html)

---
Source page: https://erroneo.us/security/briefs/papercut-ng-mf-cve-2023-2533-csrf-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt