PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2023-2533)

PaperCut NG/MF contains a cross-site request forgery (CSRF) vulnerability, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code.

Published Jun 20, 2023 · Updated May 29, 2026

X LinkedIn

Why patchRisk explained in plain English

Worst-case scenarioIf unpatched

A remote attacker, with administrative privileges, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2025-08-18 under CISA BOD 22-01.

How the attack worksNo clicks needed

This is a Cross-Site Request Forgery (CSRF) (CWE-352) vulnerability in PaperCut NG/MF. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes. Exploitation requires remote network access, low attack complexity, an administrative account, and user interaction required.

Am I affected?Quick check

Probably yes if any of these apply:

●IT Security

●Running papercut mf: v < 20.1.8, 21.0.0 ≤ v < 21.2.12, 22.0.0 ≤ v < 22.1.1; papercut ng: v < 20.1.8, 21.0.0 ≤ v < 21.2.12, 22.0.0 ≤ v ≤ 22.1.1

Real-world incidentsWhat we've seen

Active exploitation documented in the wild. Threat-research write-up: https://fluidattacks.com/advisories/arcangel/

How to patch

Manual remediation steps

Apply the Vendor Patch

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog — apply the vendor's security update as soon as possible.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.