Skip to content
COOEY

FAIL › dossier

NG/MF

PRODUCT

· dossier confidence 20%

PaperCut NG/MF is a widely deployed print management platform with a severe security track record. Multiple critical and high-severity vulnerabilities have been actively exploited in the wild, including unauthenticated configuration changes, CSRF attacks, and authentication bypasses that allow arbitrary code execution and unauthorized access to print systems.

Failure events
4
Zero-days
1
RCEs
2
On KEV
4
Critical
1
Worst shame
85
PROFILE
Categoryprint-management-softwareWhat they doPaperCut NG/MF is a print management platform used to manage printers and MFDs across enterprise, education, healthcare, and government environments. Websitehttps://www.papercut.com/ ↗
SECURITY POSTURE

The vendor has a poor security track record, with multiple high and critical vulnerabilities actively exploited in the wild, including unauthenticated configuration manipulation, CSRF, and authentication bypass flaws that allow arbitrary code execution and unauthorized access to print management systems.

Notable failures
  • CVE-2026-82078: Unsafe reflection flaw enabling arbitrary Java bytecode execution
  • CVE-2026-81578: Unauthenticated remote configuration modification
  • CVE-2023-2533: CSRF vulnerability exploited in the wild
  • CVE-2023-27351: Authentication bypass via SecurityRequestFilter class
Patterns: repeated unpatched edge-device RCEs; unauthenticated configuration manipulation; authentication bypasses in core security filters
FAILURE HISTORY · 4
DATEEVENTSEVSUMMARY
2026-08-31 CVE-2026-82078 high PaperCut NG/MF's unsafe reflection flaw lets attackers execute arbitrary Java bytecode on the server, enabling configuration manipulation and arbitrary code execution.
2026-08-31 CVE-2026-81578 high An unauthenticated remote attacker can modify critical system configurations in PaperCut NG/MF, which can be chained with another vulnerability to escalate privileges.
2025-07-28 CVE-2023-2533 high PaperCut NG/MF had a CSRF vulnerability exploited in the wild, allowing attackers to alter security settings or execute arbitrary code without user consent.
2026-04-20 CVE-2023-27351 critical PaperCut NG/MF allows remote attackers to bypass authentication via the SecurityRequestFilter class, enabling unauthorized access to print management systems.
DOSSIER SOURCES
Open questions: Exact founding year and headquarters location of PaperCut · Current organizational size and employee count
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-01 04:00:59.657646+00:00