Vulnerability Intelligence Report
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
CVE-2023-26359
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CISA KEV
SSVC: Active Exploitation
Automatable
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:17.94%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-502 ↗Deserialization of Untrusted Data (CWE-502)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Adobe | ColdFusion | unspecified <= CF2018U15, CF2021U5 (affected), unspecified <= None (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Adobe Systems Incorporated · Vendor · USA |
| Reserved | 2023-02-22T00:00:00 |
| Published | 2023-03-23T00:00:00 |
| Patch Date | 2023-03-14 |
| Last Updated | 2025-10-21T23:15:22 |
Community Chatter & Buzz