CVE-2023-26359criticalunder attackCWE-502

CVE-2023-26359: critical vulnerability in Adobe ColdFusion

Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

Published · Updated

Follow this CVE+ Monitor ColdFusion

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 17%
from disclosure to weapon
Published on NVDMar 23
CISA KEV+151d
Action required by CISAfederal deadline: 2023-09-11

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Adobe ColdFusion has a critical flaw that allows attackers to run malicious code on affected servers by sending specially crafted data. No user interaction is needed—attackers can exploit this remotely.

Technical detail

ColdFusion versions 2018 Update 15 and earlier, and 2021 Update 5 and earlier are vulnerable to unsafe deserialization (CWE-502) of untrusted input, enabling remote code execution in the context of the application user without requiring authentication or user interaction.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Adobe · ColdFusion
Related CVEs — Adobe ColdFusion

In the same product, most dangerous first.

CVE-2023-29300CRITICALAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionEPSS 100.0%KEVCVE-2018-15961CRITICALCVE-2018-15961EPSS 100.0%KEVCVE-2023-29298HIGHAdobe ColdFusion Improper Access Control Security feature bypassEPSS 99.8%KEVCVE-2023-38205HIGHColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298EPSS 99.8%KEVCVE-2024-20767HIGHColdFusion | Improper Access Control (CWE-284)EPSS 98.5%KEVCVE-2023-26360HIGHAdobe ColdFusion Improper Access Control Arbitrary code executionEPSS 97.3%KEV