← CVE Radar
CVE-2023-26360Adobe ColdFusion Improper Access Control Arbitrary code execution
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
9.8 CRITICALEPSS 97.33%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 8.6 | HIGH | 3.1adobe (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
CISA required action
⚡ Known exploited · remediation due Apr 5, 2023
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2023-26360
- Status
- Analyzed
- Assigner (CNA)
- adobe
- Published
- Mar 23, 2023
- Last modified
- 2026-06-17 05:43 UTC
- Weaknesses
- CWE-284 · Improper Access Control (CWE-284)
Affected Products
As published by the CNA in the CVE record.
AdobeColdFusion3 version ranges
- through CF2018U15
- through CF2021U5
- through None
References
- packetstormsecurity.com http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html
- helpx.adobe.com https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360