CVE-2023-26360

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.973 · 100 %ileexploit · weaponizedDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 8 exploits · weaponized

Likely / severe?

97.3% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

7 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2023-03-15remediate by 2023-04-05

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-26

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

cvss

Technical severity, 0–10. One row per scoring source.

9.9

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.6–9.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.9criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:Nsecondary · ENISA EU

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:Nsecondary · psirt@adobe.comexploitability 3.9 · impact 4

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USCWE-284US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (8)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/adobe_coldfusion_rce_cve_2023_26360Adobe ColdFusion Unauthenticated Remote Code Executionweaponized · metasploit
auxiliary/gather/adobe_coldfusion_fileread_cve_2023_26360Adobe ColdFusion Unauthenticated Arbitrary File Readfunctional · metasploit
CuriousLearnerDev/ColdFusion_EXp Adobe ColdFusion CVE-2023-26360/CVE-2023-29298 自动化实现反弹PoC · poc_in_github
H3rm1tR3b0rn/CVE-2023-26360-RCEExploit for Remote Code Execution in ColdFusion 2021 (CVE-2023-26360)PoC · poc_in_github
RyanRodrigues880/CVE-2023-26360Exploit - CVE-2023-26360PoC · poc_in_github
jakabakos/CVE-2023-26360-adobe-coldfusion-rce-exploitjakabakos/CVE-2023-26360-adobe-coldfusion-rce-exploitPoC · poc_in_github

affected products (7)

Products and version ranges known to be affected.

Adobe ColdFusion≤ unspecified ≤Noneenisa_euvdEU
Adobe ColdFusion≤ unspecified ≤CF2021U5enisa_euvdEU
Adobe ColdFusion≤ unspecified ≤CF2018U15enisa_euvdEU
Adobe Systems Inc. ColdFusion≤ 2021 до Update 5fstec_bduRU
Adobe Systems Inc. ColdFusion≤ 2018 до Update 15fstec_bduRU
adobe coldfusion= 2018nvdUScpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*
adobe coldfusion= 2021nvdUScpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-0653Adobe ColdFusion: Mehrere SchwachstellenDeutsch2023-03-14csaf · cert_bundDE
EincAngreifer kann mehrere Schwachstellen in Adobe ColdFusion ausnutzen, um beliebigen Programmcode auszuführen und vertrauliche Informationen offenzulegen.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd cert_bund NVD CVE.org MITRE

published 2023-03-23modified 2026-06-17

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan