Vulnerability Intelligence Report
Adobe ColdFusion Improper Access Control Arbitrary code execution
CVE-2023-26360
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
Automatable
CVSS Base Score
8.6
HIGH
Exploitability:3.9
Impact Score:4.0
EPSS Probability:97.11%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-284 ↗Improper Access Control (CWE-284)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Adobe | ColdFusion | unspecified <= CF2018U15 (affected), unspecified <= CF2021U5 (affected), unspecified <= None (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
97.115%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Adobe Systems Incorporated · Vendor · USA |
| Reserved | 2023-02-22T00:00:00 |
| Published | 2023-03-23T00:00:00 |
| Patch Date | 2023-03-14 |
| Last Updated | 2025-10-21T23:15:21 |
Community Chatter & Buzz