PaperCut vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited PaperCut flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-82078 PaperCut NG/MF Unsafe ReflectionExploited since Aug 31, 2026 · CVSS 9.4
• CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical FunctionExploited since Aug 31, 2026 · CVSS 8.8
• CVE-2023-27351 PaperCut NG/MF Improper AuthenticationExploited since Apr 20, 2026 · ransomware · CVSS 7.5
• CVE-2023-2533 PaperCut NG/MF Cross-Site Request Forgery (CSRF)Exploited since Jul 28, 2025 · CVSS 8.4
• CVE-2023-27350 PaperCut MF/NG Improper Access ControlExploited since Apr 21, 2023 · ransomware · CVSS 9.8

Latest high and critical flaws

• CVE-2026-82077 An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allowsHigh 7.3 · Sep 24, 2026
• CVE-2026-14780 A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedHigh 7.5 · Sep 24, 2026
• CVE-2026-82078 PaperCut NG/MF Unsafe ReflectionExploited · Critical 9.4 · Aug 28, 2026
• CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical FunctionExploited · High 8.8 · Aug 28, 2026
• CVE-2026-6645 An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows.High 7.3 · Jun 22, 2026
• CVE-2025-9785 PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management.High 7.7 · Sep 3, 2025
• CVE-2023-39470 PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability.High 7.2 · Nov 22, 2024
• CVE-2024-8404 An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled.High 7.8 · Sep 25, 2024
• CVE-2024-4712 An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled.High 7.8 · May 14, 2024
• CVE-2024-3037 An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled.High 7.8 · May 14, 2024
• CVE-2023-39469 PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability.High 7.2 · May 2, 2024
• CVE-2024-1882 This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hostHigh 7.2 · Mar 14, 2024
• CVE-2024-1654 This vulnerability potentially allows unauthorized write operations which may lead to remote code execution.High 7.2 · Mar 13, 2024
• CVE-2024-1222 This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges.High 8.6 · Mar 13, 2024
• CVE-2023-6006 This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG.High 7.8 · Nov 13, 2023
• CVE-2023-39143 PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files.Critical 9.8 · Aug 4, 2023
• CVE-2023-3486 An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PHigh 8.2 · Jul 25, 2023
• CVE-2023-2533 PaperCut NG/MF Cross-Site Request Forgery (CSRF)Exploited · High 8.4 · Jun 20, 2023
• CVE-2023-27351 PaperCut NG/MF Improper AuthenticationExploited · High 7.5 · Apr 20, 2023
• CVE-2023-27350 PaperCut MF/NG Improper Access ControlExploited · Critical 9.8 · Apr 20, 2023
• CVE-2019-12135 An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackersCritical 9.8 · Jun 6, 2019
• CVE-2019-8948 PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.Critical 9.8 · Feb 19, 2019
• CVE-2014-2657 Unspecified vulnerability in the print release functionality in PaperCut MF before 14.1 (Build 26983) has unknown impact and remote vectors, related to embeddedHigh 7.5 · Apr 28, 2014