CVE-2023-26360

Adobe ColdFusion is an application platform many businesses use to run web apps. This bug lets an attacker reach the server from the internet and start running their own code, without any login and without needing you (or your users) to click anything. Think of it like leaving an unlocked door to a back room where someone can operate your tools directly.

This matters if you run Adobe ColdFusion as part of your business website or internal applications. It’s especially important if ColdFusion is reachable from the network and you’re on a vulnerable version (2018 Update 15 or earlier, or 2021 Update 5 or earlier). The risk is only present when an attacker can reach the ColdFusion service over the network and your version is vulnerable; no attacker login is required.

This is RED because confirmed exploitation is indicated by CISA’s KEV listing (added 2023-03-15) and attackers are already able to trigger arbitrary code execution remotely. Since the flaw needs no authentication and no user interaction, leaving it unpatched exposes your server immediately to internet-based attacks.

Confirm whether you’re exposed

1. Identify your Adobe ColdFusion version on the server (from your ColdFusion installation/version info).
2. Check whether it falls into either affected range:
   • 2018 Update 15 or earlier
   • 2021 Update 5 or earlier

Remediate (target fix)

3. Upgrade to the fixed version(s) provided by Adobe for APSB23-25 (this is the referenced vendor remediation link).
4. Follow Adobe’s update procedure exactly for your installed edition and deployment model.
5. After the upgrade:
   • Confirm the ColdFusion version is now outside the affected ranges.
   • Restart the ColdFusion service if your update steps require it.

If patching is delayed (temporary risk reduction)

6. Reduce network exposure while you schedule the upgrade:
   • Restrict inbound access to the ColdFusion service to only trusted IPs (for example, your load balancer or internal network).
   • Block direct internet access to the ColdFusion host/ports at the firewall/WAF.
     (These steps don’t fix the vulnerability, but they limit who can reach it.)

What to monitor

7. Review logs (ColdFusion application logs and OS/web server logs) for suspicious requests targeting ColdFusion endpoints shortly before and after the change.
8. Watch for signs of unexpected processes/changes running under the ColdFusion service account.

CISA timeline

9. CISA KEV remediation due date was 2023-04-05 for the KEV entry related to this vulnerability.

CVE-2023-26360 is a high-severity (CVSS 8.6) issue in Adobe ColdFusion caused by an Improper Access Control flaw (CWE-284). The key mechanism is that a remote attacker can bypass access controls and trigger arbitrary code execution as the current user without authentication or user interaction, over the network.

Exploitation status: CISA KEV lists this vulnerability (added 2023-03-15) with a remediation due date of 2023-04-05, indicating real-world exploitability and requiring vendor-updated remediation.

Exploit maturity: public exploit availability has been reported (1 known), and the vendor fix is provided via APSB23-25. Attack prerequisites are simply running a vulnerable ColdFusion version (2018 Update 15 or earlier, or 2021 Update 5 or earlier).

EPSS: a very high prediction was provided in the input, but public KEV status is the primary basis for urgency in handling this case.