{"id":"CVE-2023-26360","kind":"vulnerability","aliases":["CVE-2023-26360"],"related":[],"title":"Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper…","description":"Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.","summary":"Adobe ColdFusion has a deserialization flaw that lets an attacker send crafted data and run code on the server. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-03-15T00:00:00+00:00","products":[{"name":"Adobe ColdFusion","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"adobe coldfusion","fixed":[],"affected":"= 2018","ecosystem":"vendor"},{"name":"adobe coldfusion","fixed":[],"affected":"= 2021","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe","coldfusion","exploited","package","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the Adobe ColdFusion updates per vendor instructions; the sources do not name the fixed version.","status":"open","published_at":"2023-03-15T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:32+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:08:32Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Adobe ColdFusion updates per vendor instructions; the sources do not name the fixed version.","reach":"internet","impact":"high","summary":"Adobe ColdFusion has a deserialization flaw that lets an attacker send crafted data and run code on the server. CISA lists it as actively exploited in the wild.","category":"package","who_cares":["coldfusion","adobe","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the ColdFusion server remotely.","analyst_note":"Find affected and fixed ColdFusion versions and a detection method in Adobe's security bulletin for CVE-2023-26360.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00044,"input_tokens":2787,"output_tokens":323,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':21A,24A '-26360':22A,25A '15':6A,72C '2018':4A,70C '2021':10A,76C '5':12A,78C 'access':86C 'activ':62B 'adob':1A,32B,39B,67C 'adobe':26A,28A,30A 'affect':16A,82C 'arbitrari':93C 'attack':48B 'cisa':58B 'code':54B,94C 'coldfus':2A,33B,40B,68C 'coldfusion':27A,29A,31A 'context':98C 'control':87C 'could':90C 'craft':50B 'current':101C 'cve':20A,23A 'data':51B 'deseri':43B 'earlier':8A,14A,74C,80C 'execut':95C 'exploit':34B,63B,103C 'flaw':44B 'host':38B 'improp':19A,85C 'interact':111C 'issu':106C 'let':46B 'list':59B 'packag':35B 'requir':109C 'result':91C 'run':53B 'self':37B 'self-host':36B 'send':49B 'server':57B 'updat':5A,11A,71C,77C 'user':102C,110C 'version':3A,69C 'vulner':88C 'wild':66B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-03-15T00:00:00+00:00","kev":{"dateAdded":"2023-03-15","dueDate":"2023-04-05","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-26360","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-26360","severity":null,"published_at":"2023-03-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-26360","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26360","severity":null,"published_at":"2023-03-23T20:15:15+00:00","modified_at":"2026-06-17T05:43:10+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}