Product of PaperCut

NG/MF

As of , 4 PaperCut NG/MF vulnerabilities are on CISA's list of exploited vulnerabilities, 1 of them used in ransomware campaigns; 3 were added in 2026. Patch first: CVE-2023-27351.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2023-27351Improper AuthenticationPaperCut NG/MFPatch nowRansomware use, listed within a year0.78
2CVE-2026-81578Missing Authentication for Critical FunctionPaperCut NG/MFPatch this weekMetasploit module; EPSS 0.850.85
3CVE-2026-82078Unsafe ReflectionPaperCut NG/MFPatch this weekMetasploit module; EPSS 0.610.61
4CVE-2023-2533Cross-Site Request Forgery (CSRF)PaperCut NG/MFPatch soon0.29

Added each year

1232025: 1120252026: 332026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20251
20263

Used in ransomware

Changes CISA made to these entries

  1. CVE-2023-27351 PaperCut NG/MFRansomware use: Unknown to Known.

Every change we recorded