CISA Warns of PaperCut RCE Vulnerability Exploited in Attacks

CISA has issued an urgent warning regarding a critical vulnerability in PaperCut NG/MF print management software that threat actors are actively exploiting in ransomware campaigns. 

The vulnerability, tracked as CVE-2023-2533, represents a significant security risk to organizations worldwide using the affected software versions.

Key Takeaways
1. CVE-2023-2533 in PaperCut NG/MF allows remote code execution.
2. CISA mandates federal agencies patch or discontinue PaperCut by August 18, 2025.
3. Immediately apply vendor patches and monitor PaperCut systems for threats.

CSRF Remote Code Execution Vulnerability

CVE-2023-2533 is classified as a Cross-Site Request Forgery (CSRF) vulnerability that affects PaperCut NG/MF software installations. 

This security flaw, categorized under CWE-352, allows attackers to potentially alter security settings and execute arbitrary code on vulnerable systems under specific conditions. 

The vulnerability’s severity stems from its ability to enable remote code execution (RCE), making it an attractive target for cybercriminals seeking to establish persistent access to enterprise networks.

The technical nature of this CSRF vulnerability means that attackers can trick authenticated users into performing unintended actions on the PaperCut application. 

When successfully exploited, the vulnerability grants attackers the capability to modify critical security configurations and potentially deploy malicious code across affected print management infrastructure. 

This combination of social engineering and technical exploitation makes the vulnerability particularly dangerous in enterprise environments where print management systems often have elevated network privileges.

CISA added CVE-2023-2533 to its Known Exploited Vulnerabilities (KEV) catalog on July 28, 2025, establishing a mandatory remediation deadline of August 18, 2025, for federal agencies. 

This three-week timeframe reflects the urgency of the threat and the active exploitation observed in the wild.

Federal agencies must either apply vendor-provided mitigations, follow applicable Binding Operational Directive (BOD) 22-01 guidance for cloud services, or discontinue use of the product if effective mitigations remain unavailable.

Mitigations

Organizations running PaperCut NG/MF installations must immediately consult the vendor’s Security Bulletin from June 2023 for specific mitigation guidance. 

While CISA has not definitively confirmed the vulnerability’s use in ransomware campaigns, the “Unknown” status regarding ransomware deployment does not diminish the critical nature of this security flaw.

Security administrators should prioritize patching efforts, implement network segmentation around print management systems, and monitor for suspicious activities targeting PaperCut installations until comprehensive remediation is completed.

Experience faster, more accurate phishing detection and enhanced protection for your business with real-time sandbox analysis-> Try ANY.RUN now