← Vulnerability Intelligence

CVE-2023-26360

High 8.6 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Metrics

CVSS 3.1
8.6 (HIGH) Score source: CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS — exploit probability
97% (percentile: 100) as of 2 November 2026
CWE
CWE-284

Affected products

adobe: coldfusion

References