{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: PaperCut vulnerabilities","home_page_url":"https://patchfirst.co/vendor/papercut/","feed_url":"https://patchfirst.co/feed/vendor/papercut.json","description":"New and newly exploited PaperCut CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-81578#kev","url":"https://patchfirst.co/cve/CVE-2026-81578/","title":"[KEV] CVE-2026-81578: PaperCut NG/MF Missing Authentication for Critical Function Vulnerability","content_text":"PaperCut · NG/MF. In CISA KEV since 2026-08-31. ENISA EUVD lists it as exploited. EPSS 84.7% (higher than 99.71% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Named in 1 threat report. Priority 83.7 of 100.","summary":"PaperCut NG/MF Missing Authentication for Critical Function Vulnerability","date_published":"2026-08-31T00:00:00.000Z","date_modified":"2026-09-14T00:16:56.000Z","tags":["kev","public-exploit","T1190","T1098"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2026-08-31","ransomware":false},"epss":{"score":0.84734,"percentile":0.99707},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"PaperCut","product":"NG/MF","techniqueIds":["T1190","T1098"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-82078#kev","url":"https://patchfirst.co/cve/CVE-2026-82078/","title":"[KEV] CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Vulnerability","content_text":"PaperCut · NG/MF. In CISA KEV since 2026-08-31. ENISA EUVD lists it as exploited. EPSS 63.0% (higher than 99.2% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 83.1 of 100.","summary":"PaperCut NG/MF Unsafe Reflection Vulnerability","date_published":"2026-08-31T00:00:00.000Z","date_modified":"2026-09-14T00:16:56.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":83.1,"kev":{"dateAdded":"2026-08-31","ransomware":false},"epss":{"score":0.63047,"percentile":0.992},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"PaperCut","product":"NG/MF","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-27351#kev","url":"https://patchfirst.co/cve/CVE-2023-27351/","title":"[KEV] CVE-2023-27351: PaperCut NG/MF Improper Authentication Vulnerability","content_text":"PaperCut · NG/MF. In CISA KEV since 2026-04-20, known ransomware use. ENISA EUVD lists it as exploited. EPSS 78.1% (higher than 99.58% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 78.2 of 100.","summary":"PaperCut NG/MF Improper Authentication Vulnerability","date_published":"2026-04-20T00:00:00.000Z","date_modified":"2026-10-01T19:17:14.000Z","tags":["kev","ransomware","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2026-04-20","ransomware":true},"epss":{"score":0.78052,"percentile":0.99575},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"PaperCut","product":"NG/MF","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-2533#kev","url":"https://patchfirst.co/cve/CVE-2023-2533/","title":"[KEV] CVE-2023-2533: PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability","content_text":"PaperCut · NG/MF. In CISA KEV since 2025-07-28. ENISA EUVD lists it as exploited. EPSS 28.8% (higher than 98.1% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059 Command and Scripting Interpreter; T1547 Boot or Logon Autostart Execution. Priority 68.8 of 100.","summary":"PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability","date_published":"2025-07-28T00:00:00.000Z","date_modified":"2026-06-17T05:52:47.000Z","tags":["kev","public-exploit","T1566.002","T1059","T1547"],"_patchfirst":{"reason":"kev","priority":68.8,"kev":{"dateAdded":"2025-07-28","ransomware":false},"epss":{"score":0.28831,"percentile":0.98146},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"PaperCut","product":"NG/MF","techniqueIds":["T1566.002","T1059","T1547"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-39470","url":"https://patchfirst.co/cve/CVE-2023-39470/","title":"CVE-2023-39470: PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability","content_text":"PaperCut · NG. Not in CISA KEV. EPSS 1.8% (higher than 78.1% of CVEs). CVSS 7.2 HIGH. Priority 65.7 of 100.","summary":"PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability","date_published":"2024-11-22T00:00:00.000Z","date_modified":"2024-12-05T14:50:39.000Z","tags":[],"_patchfirst":{"reason":"published","priority":65.7,"kev":null,"epss":{"score":0.01771,"percentile":0.78118},"cvss":{"score":7.2,"severity":"HIGH","version":"3.0"},"vendor":"PaperCut","product":"NG","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-39469","url":"https://patchfirst.co/cve/CVE-2023-39469/","title":"CVE-2023-39469: PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability","content_text":"PaperCut · NG. Not in CISA KEV. EPSS 61.4% (higher than 99.16% of CVEs). CVSS 7.2 HIGH. Priority 24.9 of 100.","summary":"PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability","date_published":"2024-05-03T00:00:00.000Z","date_modified":"2024-08-02T18:10:20.000Z","tags":[],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.61366,"percentile":0.99163},"cvss":{"score":7.2,"severity":"HIGH","version":"3.0"},"vendor":"PaperCut","product":"NG","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-1222","url":"https://patchfirst.co/cve/CVE-2024-1222/","title":"CVE-2024-1222: Incorrect authorization controls in PaperCut NG/MF APIs","content_text":"PaperCut · PaperCut NG, PaperCut MF. Not in CISA KEV. EPSS 64.0% (higher than 99.22% of CVEs). CVSS 8.6 HIGH. Priority 25.9 of 100.","summary":"Incorrect authorization controls in PaperCut NG/MF APIs","date_published":"2024-03-14T00:00:00.000Z","date_modified":"2024-09-26T03:50:54.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.9,"kev":null,"epss":{"score":0.63984,"percentile":0.99223},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"PaperCut","product":"PaperCut NG, PaperCut MF","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-1883","url":"https://patchfirst.co/cve/CVE-2024-1883/","title":"CVE-2024-1883: Reflected XSS in PaperCut NG/MF","content_text":"PaperCut · PaperCut NG, PaperCut MF. Not in CISA KEV. EPSS 61.5% (higher than 99.16% of CVEs). CVSS 6.3 MEDIUM. Priority 24.2 of 100.","summary":"Reflected XSS in PaperCut NG/MF","date_published":"2024-03-14T00:00:00.000Z","date_modified":"2024-09-26T03:43:04.000Z","tags":[],"_patchfirst":{"reason":"published","priority":24.2,"kev":null,"epss":{"score":0.61472,"percentile":0.99164},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"PaperCut","product":"PaperCut NG, PaperCut MF","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-3486","url":"https://patchfirst.co/cve/CVE-2023-3486/","title":"CVE-2023-3486: PaperCut NG Unauthenticated File Upload","content_text":"PaperCut · PaperCut NG. Not in CISA KEV. EPSS 79.2% (higher than 99.6% of CVEs). CVSS 8.2 HIGH. Priority 25.7 of 100.","summary":"PaperCut NG Unauthenticated File Upload","date_published":"2023-07-25T00:00:00.000Z","date_modified":"2024-10-23T19:02:59.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.7,"kev":null,"epss":{"score":0.79159,"percentile":0.99598},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"PaperCut","product":"PaperCut NG","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-27350#kev","url":"https://patchfirst.co/cve/CVE-2023-27350/","title":"[KEV] CVE-2023-27350: PaperCut MF/NG Improper Access Control Vulnerability","content_text":"PaperCut · MF/NG. In CISA KEV since 2023-04-21, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 79.9 of 100.","summary":"PaperCut MF/NG Improper Access Control Vulnerability","date_published":"2023-04-21T00:00:00.000Z","date_modified":"2026-06-17T05:44:50.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2023-04-21","ransomware":true},"epss":{"score":0.99999,"percentile":0.99994},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"PaperCut","product":"MF/NG","techniqueIds":["T1190","T1059","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}