---
id: "CVE-2023-26360"
kind: "vulnerability"
aliases: ["CVE-2023-26360"]
title: "Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Adobe ColdFusion", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "adobe coldfusion", "fixed": [], "affected": "= 2018", "ecosystem": "vendor"}, {"name": "adobe coldfusion", "fixed": [], "affected": "= 2021", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe", "coldfusion", "exploited", "package", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2023-03-15T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-26360", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26360", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper…

Adobe ColdFusion has a deserialization flaw that lets an attacker send crafted data and run code on the server. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe ColdFusion affected ? fixed ?
- vendor:adobe coldfusion affected = 2018 fixed ?
- vendor:adobe coldfusion affected = 2021 fixed ?

## Fix

Apply the Adobe ColdFusion updates per vendor instructions; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-26360
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-26360

## From the sources

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_