Loading story…
Security agencies warned that multiple vulnerabilities in PaperCut MF and PaperCut NG can expose organizations to serious compromise, including the actively exploited flaw CVE-2023-27350. CISA previously reported that malicious actors were exploiting the vulnerability in the wild, allowing unauthenticated attackers to gain remote access to vulnerable PaperCut application servers and potentially execute code, making internet-exposed print management systems a high-risk target.
A later security bulletin from HKCERT highlighted additional PaperCut vulnerabilities, reinforcing ongoing risk around the platform and the need for prompt remediation. Together, the advisories indicate that unpatched PaperCut deployments remain attractive entry points for attackers, with affected organizations urged to review vendor guidance, apply available updates, and assess exposed servers for signs of compromise.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
HKCERT published a security bulletin covering multiple vulnerabilities in PaperCut products. The notice served as a later advisory reference for PaperCut-related security issues.
CISA published advisory AA23-131A stating that malicious actors were actively exploiting CVE-2023-27350 in PaperCut MF and NG. The advisory provided mitigation guidance and highlighted the risk of unauthorized access through the authentication bypass vulnerability.
PaperCut disclosed two vulnerabilities affecting PaperCut MF and NG, including CVE-2023-27350, an authentication bypass flaw, and CVE-2023-27351, an information disclosure issue. The flaws became the basis for subsequent exploitation activity and defensive guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PaperCut disclosed an urgent security bulletin for its **MF/NG** products after vulnerabilities tracked as `PO-1216` and `PO-1219` were identified, with patches made available in March 2023. Subsequent reporting said the flaws had been reported earlier by Trend Micro and affected internet-exposed print management servers, prompting organizations to update systems immediately. Ransomware operators, including actors linked to **CL0P** and other groups, were later reported exploiting the PaperCut vulnerabilities during intrusions, adding the bugs to a broader surge in ransomware activity. Separate April 2023 ransomware tracking also noted continued high victim volumes globally, with **LockBit** leading leak-site postings and **AlphV/BlackCat** and **BianLian** increasing activity, underscoring how quickly newly disclosed enterprise software flaws were being weaponized.
Aug 15, 2026
Multiple vulnerabilities in the Common Unix Printing System (**CUPS**) were publicly disclosed, including flaws that can be chained into **remote code execution** on affected Linux and Unix systems. Reporting described the issue as a critical CUPS-based RCE risk, while an `oss-security` disclosure listed multiple **CVEs** tied to the print server and related components, expanding the scope from a single bug to a broader set of weaknesses in widely deployed printing infrastructure. Subsequent coverage said AI agents were able to identify vulnerabilities in the same Linux and Unix print server stack, underscoring how quickly offensive research techniques can surface exploitable flaws in foundational services. Because CUPS is commonly enabled across enterprise and workstation environments, the disclosures raised concern that exposed or reachable print services could provide attackers with a path to execute code remotely, making patching, service exposure review, and printer-related attack surface reduction urgent priorities.
Jul 12, 2026
**Canon** disclosed patches for multiple **remote code execution** vulnerabilities affecting the *imageCLASS MF654Cdw* printer, following coordinated publication through **Zero Day Initiative** advisories tied to *Pwn2Own*. The flaws allow **network-adjacent, unauthenticated attackers** to execute arbitrary code in the context of the device, and each advisory assigns a **CVSS 8.8** severity rating. The vulnerabilities were reported in November 2025 and publicly released in March 2026, with Canon directing customers to its product security guidance for updates. The disclosed issues affect several distinct attack surfaces on the printer. **CVE-2025-14232** is a stack-based buffer overflow in **XPS** file parsing, **CVE-2025-14235** is an out-of-bounds write in **TrueType font** parsing, **CVE-2025-14234** is a heap-based buffer overflow triggered by a crafted font in a **PJCC** request within the **CADM** service listening on `TCP/9013`, and **CVE-2025-14236** is a stack-based buffer overflow in the `dtdc_addr_importSub` method. Together, the advisories indicate that malicious print content or protocol requests could be used to compromise exposed devices, reinforcing the need to patch internet-reachable and internally accessible printers promptly.
Jun 29, 2026