CVE-2023-27350 Technical Vulnerability Analysis & Patch Advisory (CVSS 9.8)
Executive & SecOps Summary
SECOPS ASSESSMENTSystems running unpatched versions impacted by CVE-2023-27350
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentic...
Apply vendor security patches and restrict external network exposure.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUNDRemediation Steps
- Upgrade to the latest patched release from the vendor.
- Apply virtual patching or network segmentation until maintenance windows allow full patching.
Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
Technical Overview
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
- CVSS Score: 9.8 (CRITICAL)
- CWE IDs: CWE-284
Official Vendor Advisories & References
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
Frequently Asked SecOps Questions (CVE-2023-27350)
FAQQ1. How critical is CVE-2023-27350 and is it actively exploited in the wild?
CVE-2023-27350 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-27350?
Primary impacted vendors include security-advisory across enterprise-software. Scope summary: All unpatched versions listed in the official NVD CPE configurations
Q3. What temporary mitigations or workarounds exist for CVE-2023-27350 before patching?
[Mitigation] Apply vendor security patches and restrict external network exposure. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-27350
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (security-advisory)
View Category →CVE-2026-120114 Technical Vulnerability Analysis & Patch Advisory (CVSS 7.2)
[Affected Scope] Systems running unpatched versions impacted by CVE-2026-120114
Joomla JCE Editor Extension Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-48907)
[Affected Scope] Vulnerable versions of the JCE (Joomla Content Editor) extension for Joomla CMS
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.