CVEvulnerability

CVE-2023-26360

8.6 HIGH Known exploited Published 2023-03-23 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability — Adobe ColdFusion

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.

Added to KEV
2023-03-15
Remediation due
2023-04-05
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html; https://nvd.nist.gov/vuln/detail/CVE-2023-26360
Status
Analyzed
Published
2023-03-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284

Description

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Affected configurations

• adobe coldfusion 2018 • adobe coldfusion 2021

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References