Vendor dossier / #49
PaperCut vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 5 PaperCut vulnerabilities as of catalog 2026.09.23, 0.3% of all 1,721 entries and rank 49 of 283 vendors. The first was added on 2023-04-21 and the most recent on 2026-08-31; 2 are flagged as used in ransomware campaigns.
- KEV entries
- 50.3% of catalog
- Last 90 days
- +2added
- Ransomware: known
- 240%
- Products
- 2distinct
- First added
- 2023-04-21
- Latest added
- 2026-08-31
- Median days to due
- 14
- Open deadlines
- 0federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 0 |
| 2022 | 0 |
| 2023 | 1 |
| 2024 | 0 |
| 2025 | 1 |
| 2026 | 3 |
QCommon questions
How many PaperCut vulnerabilities are in CISA KEV?
5, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 0.3% of the catalog.
Which PaperCut product has the most KEV entries?
NG/MF, with 4 entries. 2 products appear in total.
How many PaperCut KEV vulnerabilities are linked to ransomware?
2 of 5 (40%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest PaperCut vulnerability added to KEV?
2026-08-31 (CVE-2026-82078).
What is the most common weakness in PaperCut KEV entries?
CWE-470 (CWE-470), listed on 1 entry.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| NG/MF | 4 | 80% |
| MF/NG | 1 | 20% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-470 | 1 | 20% |
| CWE-306 Missing authentication | 1 | 20% |
| CWE-287 Improper authentication | 1 | 20% |
| CWE-352 Cross-site request forgery | 1 | 20% |
| CWE-284 Improper access control | 1 | 20% |
EAll 5 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2026-82078 | NG/MF | PaperCut NG/MF Unsafe Reflection Vulnerability | Unknown | CWE-470 | ||
| CVE-2026-81578 | NG/MF | PaperCut NG/MF Missing Authentication for Critical Function Vulnerability | Unknown | CWE-306 | ||
| CVE-2023-27351 | NG/MF | PaperCut NG/MF Improper Authentication Vulnerability | Known | CWE-287 | ||
| CVE-2023-2533 | NG/MF | PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability | Unknown | CWE-352 | ||
| CVE-2023-27350 | MF/NG | PaperCut MF/NG Improper Access Control Vulnerability | Known | CWE-284 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 5 PaperCut vulnerabilities (0.3% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/papercut/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about PaperCut beyond this data.