# PaperCut vulnerabilities & exploitation **CISA KEV** · **Ransomware** > As of 2026-10-14, Threadlinqs tracks 6 PaperCut CVEs, 4 in the CISA Known Exploited Vulnerabilities catalog, 2 used in ransomware campaigns, linked to 6 tracked threat campaigns and 4 named threat actors. **Data as of:** 2026-10-14 ## Exploitation timeline Threadlinqs has recorded 6 PaperCut CVEs published between 2023-04-15 and 2026-09-15. The busiest month was 2026-08 (3 new CVEs). 4 of them (67%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked PaperCut CVEs. - [CVE-2023-27350](https://intel.threadlinqs.com/cve/CVE-2023-27350) — CRITICAL 9.8 · KEV · Ransomware · EPSS 100% · 2023-04-20 - [CVE-2026-81578](https://intel.threadlinqs.com/cve/CVE-2026-81578) — CRITICAL 9.8 · KEV · EPSS 85.6% · 2026-08-28 - [CVE-2023-27351](https://intel.threadlinqs.com/cve/CVE-2023-27351) — HIGH 7.5 · KEV · Ransomware · EPSS 78.1% · 2023-04-20 - [CVE-2026-82078](https://intel.threadlinqs.com/cve/CVE-2026-82078) — CRITICAL 9.1 · KEV · EPSS 63.5% · 2026-08-28 - [CVE-2026-82077](https://intel.threadlinqs.com/cve/CVE-2026-82077) — HIGH 7.3 · EPSS 0.7% · 2026-09-24 - [CVE-2026-8794](https://intel.threadlinqs.com/cve/CVE-2026-8794) — MEDIUM 6.9 · EPSS 0.7% · 2026-08-03 ## Products affected Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 4 distinct PaperCut products are affected. The most frequently affected: - MF/NG — 2 CVEs - Mf — 2 CVEs - NG/MF — 2 CVEs - Ng — 2 CVEs ## Threat activity 6 tracked threat campaigns reference PaperCut products or exploit PaperCut CVEs: - [Cl0p Ransomware MFT Attack Pattern: Multi-Year Zero-Day Campaigns Against File Transfer and Enterprise Software (2020-2025)](https://intel.threadlinqs.com/threat/TL-2026-3070) — HIGH — 2026-10-09 - [PaperCut NG/MF Actively Exploited Zero-Day Vulnerability Affects All Supported Versions (No CVE Assigned)](https://intel.threadlinqs.com/threat/TL-2026-2178) — CRITICAL — 2026-08-28 - [PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & CVE-2026-81578) Under Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-2184) — CRITICAL — 2026-08-28 - [LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)](https://intel.threadlinqs.com/threat/TL-2026-2094) — HIGH — 2026-08-21 - [Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands](https://intel.threadlinqs.com/threat/TL-2026-1710) — MEDIUM — 2026-07-22 - [Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (CVE-2026-23760, CVE-2025-10035)](https://intel.threadlinqs.com/threat/TL-2026-0326) — CRITICAL — 2026-04-06 ## Threat actors targeting PaperCut Named threat actors attributed to campaigns that involve PaperCut products or CVEs, with the number of linked campaigns: - [LockBit](https://intel.threadlinqs.com/actor/LockBit) — 2 campaigns - [Cl0p](https://intel.threadlinqs.com/actor/Cl0p) — 1 campaign - [Nitrogen](https://intel.threadlinqs.com/actor/Nitrogen) — 1 campaign - [Storm-1175](https://intel.threadlinqs.com/actor/Storm-1175) — 1 campaign ## How to prioritise PaperCut patching This order follows the data Threadlinqs holds for PaperCut, not a generic severity checklist: - 4 of 6 PaperCut CVEs (67%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2023-27350](https://intel.threadlinqs.com/cve/CVE-2023-27350), [CVE-2026-81578](https://intel.threadlinqs.com/cve/CVE-2026-81578), [CVE-2023-27351](https://intel.threadlinqs.com/cve/CVE-2023-27351). - 2 CVEs are known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems. - Outside KEV, the highest EPSS scores are [CVE-2026-82077](https://intel.threadlinqs.com/cve/CVE-2026-82077) (0.7%), [CVE-2026-8794](https://intel.threadlinqs.com/cve/CVE-2026-8794) (0.7%). - 3 CVEs score Critical and 2 High on CVSS v3 (maximum 9.8, average 8.4); sequence these after KEV and high-EPSS items. - 4 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-14 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/papercut All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp