8.6High
KEV
CVE-2023-26360Adobe ColdFusion Improper Access Control Arbitrary code execution
Known exploited — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
CISA confirmed this vulnerability is used in real attacks on 15.03.2023. Remediation deadline for US federal agencies: 05.04.2023.
Required action: Apply updates per vendor instructions. https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html; https://nvd.nist.gov/vuln/detail/CVE-2023-26360
Description
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
Weakness (CWE):
CWE-284
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Adobe | ColdFusion | unspecified – ≤ CF2018U15, unspecified – ≤ CF2021U5, unspecified – ≤ None |
References and patches
- https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html PatchVendor Advisory
- http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360 Third Party AdvisoryUS Government Resource
CPE matches (NVD) (22)
cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*