CVE-2023-29298

Adobe ColdFusion Improper Access Control Security feature bypass

Exploited in the wild. In CISA KEV since 2023‑07‑20. A vendor fix is available.

CVSS 3.17.5High EPSS percentile99th100% chance in 30 days CISA KEVListedsince 2023-07-20, due 2023-08-10
No public exploit known FixVendor fixNo build named by the sources

Published 2023-07-12Updated 2025-10-23Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Adobe ColdFusion version you run (and whether the admin endpoints/CFM-CFC handlers are reachable from your network).
If you are on 2018u16 or earlier, upgrade ColdFusion to 2018u17.
If you are on 2021u6 or earlier, upgrade ColdFusion to 2021u7.
If you are on 2023.0.0.330468 or earlier, upgrade ColdFusion to 2023.0.0.330469.
If you cannot upgrade immediately, apply the mitigations from Adobe’s APSB23-40 advisory and temporarily restrict network access to the affected admin endpoints until patched.

Vendor advisory Some work to apply

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

In plain language

Written by AI from the record

CVE-2023-29298 is a ColdFusion security flaw that lets attackers reach restricted admin files without logging in; most small businesses should treat this as an urgent, patch-now risk because it has been used in real attacks.

CVE-2023-29298 is an Improper Access Control issue in Adobe ColdFusion that enables security feature bypass, allowing unauthenticated network access to restricted administrative CFM/CFC endpoints; it is listed in CISA KEV and has been exploited in the wild.

If you're affected

Unauthorized admin file access
Complete application compromise risk
Data theft risk
Service disruption risk

What is it

This bug acts like a “locked door” that can be opened without a key. In affected Adobe ColdFusion setups, an attacker can bypass access controls and reach restricted admin parts of the system that normally should only be accessible to authorized users.

If someone can access those admin functions, they may be able to view or change things they shouldn’t, which can lead to stolen data or outages.

Who is affected

This matters if you run Adobe ColdFusion (especially versions at or below the affected levels) and your server’s network is exposed in a way that allows access to the administrative CFM/CFC endpoints.

This is a “no login needed” issue (no authentication or user interaction required), so the key question is whether an attacker can reach those endpoints over the network in your environment.

How urgent is it

This is RED because it’s confirmed to have been exploited and is in the CISA KEV catalog with a past remediation deadline. Attackers can reach restricted admin endpoints over the network without needing a login, which makes exposure especially risky for internet-reachable ColdFusion servers.

Act immediately to verify your version and apply Adobe’s fixed update or the published mitigations.

What to do — in detail

Confirm exposure

Identify your installed Adobe ColdFusion version.
Verify whether the ColdFusion admin functionality that maps to the CFM/CFC endpoints is reachable from any untrusted network (for example, directly over the internet, or from outside your office/VPN).

Patch (preferred)

Apply the fixed releases called out by Adobe for CVE-2023-29298 (per APSB23-40):

For Adobe ColdFusion 2018u16 or earlier: upgrade to 2018u17.
For Adobe ColdFusion 2021u6 or earlier: upgrade to 2021u7.
For Adobe ColdFusion 2023.0.0.330468 or earlier: upgrade to 2023.0.0.330469.

If you can’t patch right away (temporary mitigation)

Follow Adobe’s APSB23-40 instructions and apply the available mitigations.
In parallel, restrict network access so that the affected administrative endpoints (CFM/CFC admin surfaces) are not reachable from untrusted networks until the upgrade is complete.

What to monitor after changes

Look for unusual inbound requests hitting ColdFusion admin-related endpoints.
Check for unexpected creation/changes of admin-accessible files or configuration changes.

KEV timing

CISA KEV lists this issue with a remediation due date of 2023-08-10. Since exploitation has been observed in the wild, prioritize getting to the fixed versions now.

Technical context

CVE-2023-29298 is an Improper Access Control weakness (CWE-284) in Adobe ColdFusion that permits security feature bypass. The attacker can access restricted administrative CFM and CFC endpoints over the network without authentication and without user interaction.

Exploitation status: It is listed in CISA KEV (added 2023-07-20) with a CISA remediation due date of 2023-08-10, and reporting indicates exploitation attempts in the wild. Press reporting notes exploitation attempts detected on July 2 following technical analysis.

Attack vector: network-based access to administrative endpoints.

Exploit maturity: weaponization is indicated as at least “detection template” level in the provided findings, while the KEV/news confirm active attacker interest and real-world exploitation attempts.

KEV meaning here: inclusion in CISA KEV indicates the issue is recognized as having real-world impact and warrants mitigation or discontinuation per CISA guidance.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2023-07-20.

US federal agencies must remediate by 2023-08-10.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

100% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 1079 days, from the signal feeds we watch.

2026-06-25OpenVAS check added
2026-03-06Nuclei check added
2025-10-23Patch availablerecord updated
2023-07-20Added to CISA KEV
2023-07-12Publishedweakness classified

Affected products

Adobe Systems Inc.commercial · USaka Adobe
- ColdFusionConsumer Software

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact