CVE-2023-26360

Adobe ColdFusion Improper Access Control Arbitrary code execution

Exploited in the wild. In CISA KEV since 2023‑03‑15. A vendor fix is available.

CVSS 3.18.6High EPSS percentile99th97% chance in 30 days CISA KEVListedsince 2023-03-15, due 2023-04-05
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2023-03-23Updated 2025-10-23Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Adobe ColdFusionAffected: ≥ unspecified, ≤ CF2018U15Upgrade to: after CF2018U15Affected: ≥ unspecified, ≤ CF2021U5Upgrade to: after CF2021U5Affected: ≥ unspecified, ≤ NoneUpgrade to: after NoneStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Adobe ColdFusion server is running a vulnerable version: 2018 Update 15 or earlier, or 2021 Update 5 or earlier.
If it is vulnerable, immediately upgrade ColdFusion using Adobe’s instructions for APSB23-25.
After updating, verify the ColdFusion version is no longer in the affected range and restart the service if your update process requires it.
Confirm no unexpected changes occurred by reviewing ColdFusion and OS logs around the upgrade window.

Vendor advisory Some work to apply

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

0 publishers

Added to CISA KEV catalog
Mar 15, 2023·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

In plain language

Written by AI from the record

CVE-2023-26360 is a vulnerability in Adobe ColdFusion that lets attackers run code on your server over the network without logging in or tricking anyone—typical small businesses using ColdFusion should treat this as an urgent patch.

CVE-2023-26360 is an Improper Access Control weakness in Adobe ColdFusion that allows unauthenticated remote attackers to trigger arbitrary code execution as the current user over the network.

If you're affected

Full server compromise
Malware persistence risk
Customer or file data exposure
Service disruption

What is it

Adobe ColdFusion is an application platform many businesses use to run web apps. This bug lets an attacker reach the server from the internet and start running their own code, without any login and without needing you (or your users) to click anything. Think of it like leaving an unlocked door to a back room where someone can operate your tools directly.

Who is affected

This matters if you run Adobe ColdFusion as part of your business website or internal applications. It’s especially important if ColdFusion is reachable from the network and you’re on a vulnerable version (2018 Update 15 or earlier, or 2021 Update 5 or earlier). The risk is only present when an attacker can reach the ColdFusion service over the network and your version is vulnerable; no attacker login is required.

How urgent is it

This is RED because confirmed exploitation is indicated by CISA’s KEV listing (added 2023-03-15) and attackers are already able to trigger arbitrary code execution remotely. Since the flaw needs no authentication and no user interaction, leaving it unpatched exposes your server immediately to internet-based attacks.

What to do — in detail

Confirm whether you’re exposed

Identify your Adobe ColdFusion version on the server (from your ColdFusion installation/version info).
Check whether it falls into either affected range:
- 2018 Update 15 or earlier
- 2021 Update 5 or earlier

Remediate (target fix)

Upgrade to the fixed version(s) provided by Adobe for APSB23-25 (this is the referenced vendor remediation link).
Follow Adobe’s update procedure exactly for your installed edition and deployment model.
After the upgrade:
- Confirm the ColdFusion version is now outside the affected ranges.
- Restart the ColdFusion service if your update steps require it.

If patching is delayed (temporary risk reduction)

Reduce network exposure while you schedule the upgrade:
- Restrict inbound access to the ColdFusion service to only trusted IPs (for example, your load balancer or internal network).
- Block direct internet access to the ColdFusion host/ports at the firewall/WAF.
  (These steps don’t fix the vulnerability, but they limit who can reach it.)

What to monitor

Review logs (ColdFusion application logs and OS/web server logs) for suspicious requests targeting ColdFusion endpoints shortly before and after the change.
Watch for signs of unexpected processes/changes running under the ColdFusion service account.

CISA timeline

CISA KEV remediation due date was 2023-04-05 for the KEV entry related to this vulnerability.

Technical context

CVE-2023-26360 is a high-severity (CVSS 8.6) issue in Adobe ColdFusion caused by an Improper Access Control flaw (CWE-284). The key mechanism is that a remote attacker can bypass access controls and trigger arbitrary code execution as the current user without authentication or user interaction, over the network.

Exploitation status: CISA KEV lists this vulnerability (added 2023-03-15) with a remediation due date of 2023-04-05, indicating real-world exploitability and requiring vendor-updated remediation.

Exploit maturity: public exploit availability has been reported (1 known), and the vendor fix is provided via APSB23-25. Attack prerequisites are simply running a vulnerable ColdFusion version (2018 Update 15 or earlier, or 2021 Update 5 or earlier).

EPSS: a very high prediction was provided in the input, but public KEV status is the primary basis for urgency in handling this case.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2023-03-15.

US federal agencies must remediate by 2023-04-05.

Apply updates per vendor instructions.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

97% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 134 days before any public exploit.

2026-06-25OpenVAS check added
2026-03-06Public exploit / PoCsource: packetstormnuclei check added
2025-10-23Patch availablerecord updated
2023-03-23Publishedweakness classified
2023-03-15Added to CISA KEV

Affected products

Adobe Systems Inc.commercial · USaka adobe
- ColdFusionConsumer Software

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Scored 8.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact