CVE-2023-26360highunder attackCWE-284

CVE-2023-26360: high-severity vulnerability in Adobe ColdFusion

Adobe ColdFusion Improper Access Control Arbitrary code execution

Published · Updated

Follow this CVE+ Monitor ColdFusion

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.6epss 97%
from disclosure to weapon278 days
Published on NVDMar 23
1st PoC+278d
metasploitMar 14
CISA KEVMar 15
Action required by CISAfederal deadline: 2023-04-05

Apply updates per vendor instructions.

In short

Adobe ColdFusion has a flaw that allows attackers to run malicious code on affected servers without needing to trick users or log in first. This is a serious issue because it puts websites and their data at risk.

Technical detail

An improper access control vulnerability in Adobe ColdFusion 2018 Update 15 and earlier, and 2021 Update 5 and earlier, permits unauthenticated remote code execution in the context of the application user. The vulnerability requires no user interaction and can be exploited directly against vulnerable instances exposed to network access.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
Adobe · ColdFusion
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Adobe ColdFusion

In the same product, most dangerous first.

CVE-2023-29300CRITICALAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionEPSS 100.0%KEVCVE-2018-15961CRITICALCVE-2018-15961EPSS 100.0%KEVCVE-2023-38205HIGHColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298EPSS 99.8%KEVCVE-2023-29298HIGHAdobe ColdFusion Improper Access Control Security feature bypassEPSS 99.8%KEVCVE-2024-20767HIGHColdFusion | Improper Access Control (CWE-284)EPSS 98.5%KEVCVE-2023-38203CRITICALAnalysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEEPSS 97.1%KEV