BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2023-26359Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

9.8 CRITICALEPSS 16.98%⚡ Known Exploited (CISA KEV)NVD: Analyzed

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
9.8CRITICAL3.1adobe (CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Sep 11, 2023

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Details

CVE ID
CVE-2023-26359
Status
Analyzed
Assigner (CNA)
adobe
Published
Mar 23, 2023
Last modified
2026-06-17 05:43 UTC
Weaknesses
  • CWE-502 · Deserialization of Untrusted Data (CWE-502)

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 15:17 UTC.