CVE-2023-3486

What it actually does

CVE-2023-3486 is a network-reachable authentication bypass in PaperCut NG, and potentially related PaperCut MF deployments, affecting PaperCut NG versions 22.0.12 and earlier. The flaw allows a remote unauthenticated attacker to access file-upload functionality that should require authentication and write arbitrary files into the PaperCut host’s file storage area. The documented impact is availability loss: repeated or oversized uploads can consume disk space, degrade application performance, fill storage used by PaperCut services, and cause the print management service to stop operating correctly. The CVSS vector indicates exploitation is low complexity, requires no credentials, requires no user interaction, and primarily affects availability rather than confidentiality or integrity.

Why it matters to the business

An exposed vulnerable PaperCut server can be disrupted by anyone able to reach the service over the network, potentially interrupting printing operations, queue management, administrative access, and dependent business workflows. Because PaperCut often supports organization-wide printing, a successful denial-of-service condition can create broad operational disruption even without data theft. The EPSS score is high, indicating meaningful likelihood of exploitation activity in the wild despite the CVE not currently being listed in CISA KEV and no ransomware association being reported for this specific issue. The issue has been public for a long time, so unpatched systems should be treated as avoidable high-risk exposure.

How an attack unfolds

An attacker first identifies an internet-facing or internally reachable PaperCut NG or PaperCut MF server and determines whether it is running PaperCut NG 22.0.12 or earlier, or an otherwise vulnerable build. The attacker then sends crafted unauthenticated HTTP requests to the affected file-upload or file-storage workflow. Because the vulnerable component fails to enforce authentication correctly, the server accepts uploaded content from a remote unauthenticated client. The attacker can repeat the upload process, use large files, or automate concurrent uploads to consume storage on the PaperCut host. As disk space is exhausted or the PaperCut file storage area becomes overloaded, PaperCut services may slow down, fail to process jobs, log errors, or stop functioning. In a mature attack, the adversary may time the disruption to affect business operations or use it as a diversion while probing for other exposed PaperCut weaknesses.

How to fix it

Upgrade affected PaperCut NG deployments running version 22.0.12 or earlier to a vendor-supported fixed release newer than the affected range, preferably the latest available PaperCut NG or PaperCut MF version from PaperCut. If exact package-level fixed versions are not available in internal tracking, verify directly against the PaperCut vendor advisory and release notes before closing remediation. Where immediate upgrade is not possible, restrict access to the PaperCut web interface using firewall rules, VPN, reverse proxy access controls, or allowlists; block direct internet exposure; monitor and enforce disk quotas where feasible; and ensure PaperCut application storage is not colocated with critical operating system volumes. Restarting services or deleting uploaded files may restore availability temporarily, but it does not remediate the authentication bypass.

How to confirm the fix worked

Confirm the installed PaperCut version is newer than 22.0.12 or matches the vendor-designated fixed release. Validate from the PaperCut administration interface, application version files, package inventory, and vulnerability scanner results. Verify that unauthenticated users cannot access upload or file-storage workflows and that direct HTTP access to PaperCut is limited to trusted networks. Review disk utilization before and after remediation to ensure no residual uploaded files remain. If compensating controls are used, test from an untrusted network path to confirm the PaperCut service is not reachable or that the vulnerable functionality is blocked before authentication.

Typical attack path

1. Scan for externally exposed or internally reachable PaperCut NG or PaperCut MF web interfaces.
2. Fingerprint the PaperCut version or infer vulnerability based on server behavior and exposed application metadata.
3. Send unauthenticated requests to the vulnerable upload or file-storage functionality.
4. Upload arbitrary files without valid credentials.
5. Repeat uploads or use large payloads to consume disk space and application storage.
6. Monitor service responses for slowdown, errors, or outage conditions confirming denial of service.
7. Optionally maintain pressure by automating repeated uploads until the service is unavailable or administrators intervene.

How to detect it

To determine whether this issue was already exploited, review PaperCut application logs, web server or reverse proxy logs, endpoint telemetry, and filesystem artifacts on PaperCut hosts. Focus on unauthenticated or anonymous upload-like HTTP requests, large request bodies, repeated POST activity from the same source, spikes in 4xx/5xx responses, and errors indicating failed writes, low disk space, or storage exhaustion. Examine PaperCut application data, temporary, spool, and file-storage directories for unexpected files, unusually large files, burst-created files, files with suspicious extensions, or files owned by the PaperCut service account outside normal application patterns. Correlate timestamps of disk growth, PaperCut service restarts, job failures, administrator complaints, and HTTP request activity. Because the known impact is denial of service rather than confirmed code execution, detection should emphasize resource-exhaustion indicators and unauthorized uploads rather than malware-only indicators. If PaperCut is behind a proxy or load balancer, preserve upstream access logs because the PaperCut server logs may show only proxy source addresses unless forwarded headers are recorded.

• C:\Program Files\PaperCut NG\server\logs\server.log
• C:\Program Files\PaperCut MF\server\logs\server.log
• /home/papercut/server/logs/server.log
• /Applications/PaperCut NG/server/logs/server.log
• /Applications/PaperCut MF/server/logs/server.log
• C:\Program Files\PaperCut NG\server\data\
• C:\Program Files\PaperCut MF\server\data\
• /home/papercut/server/data/
• /Applications/PaperCut NG/server/data/
• /Applications/PaperCut MF/server/data/
• No space left on device
• There is not enough space on the disk
• Disk quota exceeded
• java.io.IOException: No space left on device
• java.io.FileNotFoundException
• HTTP 507
• POST /

What your security team should do

• Prioritize upgrading all PaperCut NG instances running 22.0.12 or earlier, especially internet-facing systems, because exploitation is unauthenticated, low complexity, and has a high EPSS likelihood score.
• Inventory all PaperCut NG and PaperCut MF servers, including internal print servers that may not be covered by internet-facing vulnerability scans.
• Remove direct internet exposure for PaperCut administrative and application interfaces unless there is a documented business requirement and strong access control in place.
• Review PaperCut server storage locations for unexpected large files, sudden growth, or unknown uploads, and preserve relevant logs before cleanup if exploitation is suspected.
• Create monitoring for abnormal unauthenticated POST/upload activity, rapid disk consumption, repeated large request bodies, and PaperCut service availability failures.
• Implement disk space alerting on PaperCut hosts, especially for application, spool, temporary, and PaperCut data directories.
• If suspicious activity is found, isolate the server from untrusted networks, collect logs and uploaded files for analysis, remove unauthorized content, rotate administrative credentials as a precaution, and complete the upgrade before restoring exposure.