[ CVE-2023-26360 · Published 23 Mar 2023 ]

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Exploited · CISA KEV CVSS 8.6 EPSS 97%Fix available

[ Why it matters ]Priority signals

Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-03-15
EPSS: 97% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

CISA: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 5 Apr 2023): Apply updates per vendor instructions.

Patch on helpx.adobe.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execu…ExploitThird Party AdvisoryVDB Entry
helpx.adobe.com/security/products/coldfusion/apsb23-25.htmlPatchVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogThird Party AdvisoryUS Government Resource