ZeusQA
Start free

Known exploited vulnerabilities

PaperCut vulnerabilities attackers have used

Every PaperCut vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 5 PaperCut vulnerabilities as exploited in the wild, 3 of them added in the last 12 months and 2 used in ransomware campaigns. The most recent is CVE-2026-82078, added Aug 31, 2026. NG/MF has the most entries (4).

In KEV, all time
5
Added, last 12 months
3
Used in ransomware
2
New CVEs this week
0

By product

NG/MF (4), MF/NG (1).

Every PaperCut entry in CISA KEV

  1. CVE-2026-82078

    Added · due

    PaperCut NG/MF Unsafe Reflection Vulnerability

    PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the…

  2. CVE-2026-81578

    Added · due

    PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

    PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.

  3. CVE-2023-27351

    RansomwareAdded · due

    PaperCut NG/MF Improper Authentication Vulnerability

    PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.

  4. CVE-2023-2533

    Added · due

    PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

    PaperCut NG/MF contains a cross-site request forgery (CSRF) vulnerability, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code.

  5. CVE-2023-27350

    RansomwareAdded · due

    PaperCut MF/NG Improper Access Control Vulnerability

    PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works