Papercut RCE 2023: Print Servers as the Softest Door

Quick Answer — In mid-April 2023, security teams discovered mass exploitation of CVE-2023-27350, an unauthenticated remote-code-execution flaw in PaperCut MF/NG — the humble print-management software quietly running on school district and hospital servers. Attackers chained an authentication bypass in the web-setup subsystem into full server takeover, and per vendor and researcher reporting, some intrusions were handed to ransomware crews (Cl0p among the claimed). The lesson: printer infrastructure is server infrastructure — unglamorous internal apps with internet exposure become the softest door in the house.

What happened

• The bug: CVE-2023-27350 — the PaperCut application’s setup-completion logic could be re-entered by an unauthenticated remote attacker, installing arbitrary code execution on the host. A companion flaw (CVE-2023-27351) enabled security-feature bypass. Patches shipped quietly in March; mass exploitation showed in April telemetry.
• The victims: Heavily skewed to education and healthcare — sectors that run PaperCut at scale for print quotas and follow-me printing, often on under-monitored Windows boxes, often unpatched for weeks.
• The exploitation: Huntress and others documented hands-on-keyboard intrusion: reconnaissance, discovery commands, and on some hosts deployment of additional payloads — payload chains consistent with access-broker handoff, including ransomware-adjacent activity later claimed by Cl0p.
• No auth required: The scariest property — no credentials, no user interaction, just a reachable web port. Shodan-style census showed thousands of exposed instances at disclosure time.

Why print servers became the softest target

TTP highlights (per vendor advisories and IR reporting)

• Unauthenticated POST abuse of the setup-completion flow → code execution as the service account.
• Post-exploitation: whoami / system discovery, security-product enumeration, occasional registry Run-key persistence.
• Observed monetization lanes: access resale, coin miners on idle hosts, and ransomware deployment on a subset (Cl0p publicly claimed PaperCut intrusions, per reporting).
• Victim selection consistent with opportunistic scanning, not targeting — anyone reachable and unpatched.

Timeline

Defensive lessons

• Inventory the boring software. Print management, fax gateways, door controllers — the apps nobody owns are the ones nobody patches. Asset inventories must include “unsexy” internal web apps, not just crown jewels.
• Kill accidental exposure. Print servers belong on WAN-isolated VLANs; a reverse proxy with auth beats a port-forward every time. Exposure scans should alert on any new internal-app listener.
• Patch SLAs need a KEV trigger. “Within 30 days” policies failed here; CISA KEV listing (Apr 19) should auto-escalate any matching asset to emergency patching.
• EDR on print servers too. The post-exploitation was noisy and ordinary — discovery commands, persistence keys — detectable by any standard agent that was actually installed.
• Assume handoff economics. Initial-access brokers monetize junk-server RCE the same as ERP exploits; containment planning shouldn’t rank targets by app prestige.

Why it still matters in 2026

PaperCut was 2023’s cleanest demonstration that attack surface is popularity times neglect: a wildly deployed, rarely loved application produced a victim distribution that read like a school-district directory. The pattern since — screen-connectors, file-transfer appliances, edge boxes — repeats annually with different logos. In 2026’s landscape (KEV-driven patch operations mature, exposure-management platforms commodity, but school and hospital patch capacity still chronically understaffed), the meta-lesson stands: the cheapest program win is knowing every app you run and who owns its patching. PaperCut taught it to anyone who would listen; the unpatched-exposure long tail taught it again, server by server, for another two years.

How were victims actually compromised — web shells?

Not necessarily classic web shells: the setup-flow abuse gave direct command execution, and reporting showed attackers running commands via the app’s own machinery plus occasional native persistence. The distinction matters little operationally — unauthenticated RCE is unauthenticated RCE — but detection signatures tuned for dropped shell files missed intrusions that never wrote one.

Did PaperCut handle disclosure well?

Mixed reviews: the March fixes were technically sound, but the muted advisories communicated little urgency, and the KEV listing came from external telemetry rather than vendor alarms. Vendors learned the lesson the industry keeps re-teaching: quiet patch notes don’t quiet scanners, and downplayed severity transfers all response burden to defenders.

What should an org have done that week?

Locate every PaperCut instance (MF, NG, and site servers), patch or isolate same-day, hunt for the post-exploitation IOCs in any box that had the web port reachable, and rotate service-account credentials on domain-joined print hosts. Then the structural follow-up: add print infra to the asset inventory and EDR baseline — because the next PaperCut was already shipping.

Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.

Detection and response playbook

PaperCut (CVE-2023-27350) was the perfect soft target: an unauthenticated RCE in print-management software running on servers that nobody monitored, nobody patched, and everybody forgot — exploited by both ransomware crews and state-linked actors within days of disclosure.

1. Rediscover your forgotten infrastructure. Print servers, fax gateways, scan-to-email relays, and device-management platforms form a class of always-there, never-audited services with domain credentials and OS footprints. Attack-surface scanning plus a deliberate hunt for print, scan, and peripheral services should be an annual exercise; every PaperCut victim was surprised by inventory, not by technique.
2. Detect the post-exploitation signatures. Observed chains moved from the print service to reconnaissance and staging: unusual child processes from print services, PowerShell from service accounts with no history of it, outbound connections from print infrastructure (which should egress nowhere), and new local accounts on print servers. Each is a one-line EDR rule; collectively they cover the entire observed campaign.
3. Segment the office-periphery tier. Print infrastructure needs to reach print devices and directory services — and nothing else. Network segmentation for this tier converts an RCE into a contained event; the ransomware victims of this campaign were the ones whose print servers could reach file shares and backup systems.
4. Rotate what print services hold. Print systems cache directory credentials, scan destinations contain email integrations, and management consoles hold admin accounts for fleets. After any compromise in this tier, treat it as a credential exposure event — the same rotation doctrine as CI and MFT compromises.
5. Put peripheral software on the patch calendar. The version gap in this incident was enormous — patches existed for weeks while exploitation ramped through unpatched estates. The root cause was category blindness: infrastructure that is not servers, not endpoints, and therefore in nobody patch scope. Ownership assignment for every running service is the permanent fix.

Where this sits in the broader pattern

PaperCut belongs to the forgotten-infrastructure genre alongside the Citrix and Fortinet era entries and the MOVEit family: software whose function is unglamorous, whose location is a closet or a VM nobody remembers provisioning, and whose privilege is quietly enormous. The genre includes F5 and F5-adjacent iControl issues, print-management peers, and every device-controller platform ever left unpatched through a quarterly cycle.

The dual exploitation is also the pattern: crimeware (here, Cl0p-adjacent crews and the MalasLocker wave) and state actors (a Chinese-nexus APT, per vendor attribution) hitting the same bug for different ends. When a vulnerability is easy and the targets are soft, everyone arrives — which is why exposure reduction beats response planning for this class: the cheapest time to survive a dual-audience CVE is before it exists.

The consolidation with the rest of the series is neat: inventory and ownership (the Sisense lesson), segmentation (the MFT doctrine), credential rotation on compromise (universal), and patch clocks proportional to exposure. Print servers simply combine all four requirements in the least glamorous package possible — which is exactly why they keep working as front doors.

The bottom line. The softest door in the network was the one nobody owned. Assign an owner to every running service, segment the office periphery, monitor the print tier like the domain-adjacent credential vault it is, and patch it on the same clock as the VPN. Ransomware crews and intelligence services agreed on one thing in 2023: unglamorous infrastructure is the best target — honor their consensus by defending it.

And for the inventory exercise itself, start from the printers and work backward: every device that prints, scans, or faxes maps to a controller, every controller maps to a server, and every server maps to an owner or an uncomfortable silence. The silence is the finding. Assign it an owner before the next CVE in this category assigns it an attacker, because the unclaimed corner of the network is where every incident in this genre begins, and the fix is clerical, not technical.

The corner stays claimed only when the review repeats; assign the calendar slot now.

Repeat it every quarter, forever. Unglamorous, decisive.

Frequently Asked Questions

{“@context”:”https://schema.org”,”@type”:”FAQPage”,”mainEntity”:[{“@type”:”Question”,”name”:”What is CVE-2023-27350 in PaperCut?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”An unauthenticated remote-code-execution vulnerability in PaperCut MF and NG print-management servers, exploited in the wild within days of disclosure by both ransomware operators and state-linked actors against unpatched, internet-exposed instances.”}},{“@type”:”Question”,”name”:”Why are print servers a security risk?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”They run unmonitored, patch slowly, hold directory credentials, and often sit on networks with broad reach — combining maximum forgettability with meaningful privilege, which makes them recurring initial-access targets.”}},{“@type”:”Question”,”name”:”How do you secure print management infrastructure?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Patch promptly, keep consoles off the internet, segment print tiers from file shares and backups, monitor for unusual child processes and outbound connections from print services, and rotate credentials after any suspected compromise.”}}]}

Related Reading

• What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
• Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
• 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
• Authoritative reference: CISA Known Exploited Vulnerabilities

More on this topic

• Exchange CVE-2020-0688: A Default Key Made Every Server Alike
• Citrix NetScaler CVE-2023-3519: Breached Before the Advisory
• CitrixBleed CVE-2023-4966: Session Tokens Straight From Memory

Published by Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths — written and lab-tested by the Hmmnm team.

Learning Paths · About Hmmnm · Editorial policy