PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

A remote attacker, with administrative privileges, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2025-08-18 under CISA BOD 22-01.

This is a Cross-Site Request Forgery (CSRF) (CWE-352) vulnerability in PaperCut NG/MF. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes. Exploitation requires remote network access, low attack complexity, an administrative account, and user interaction required.

Probably yes if any of these apply:

Active exploitation documented in the wild. Threat-research write-up: https://fluidattacks.com/advisories/arcangel/