CVE-2023-26359
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Description
CVE-2023-26359 is a critical deserialization of untrusted data vulnerability affecting Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier). By exploiting this flaw, an attacker can achieve arbitrary code execution in the context of the current user without any user interaction required. This deserialization vulnerability in Adobe ColdFusion has been added to CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 84.7% placing it in the 99th percentile, CVE-2023-26359 represents a severe threat to organizations running unpatched ColdFusion servers.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | coldfusion | 2018; 2021 |
References
- https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26359(Third Party Advisory, US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
In the context of CVE-2023-26359, Adobe ColdFusion improperly handles serialized data from untrusted sources, allowing attackers to inject malicious serialized objects that are deserialized by the application. This deserialization of untrusted data weakness enables arbitrary code execution because the application processes attacker-controlled serialized input without proper validation or sanitization.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2023-26359 carries a CVSS v3.1 score of 9.8 (Critical severity), reflecting the maximum possible impact across all three security dimensions. The vulnerability is remotely exploitable without physical access, easy to exploit with no special conditions needed, requires no authentication, and demands no user interaction — creating an extremely low barrier for attackers. Confidentiality (High): Attackers can access any data accessible to the ColdFusion process, including application data, configuration files, and database credentials. Integrity (High): Arbitrary code execution allows attackers to modify files, inject backdoors, alter application logic, and tamper with data. Availability (High): Attackers can disrupt ColdFusion services, crash the application, or leverage the compromised server for further attacks. The EPSS score of 84.7% indicates a very high likelihood of active exploitation, making immediate remediation essential for any organization running affected Adobe ColdFusion versions.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-26359 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of September 11, 2023. The EPSS score of 84.7% (99th percentile) indicates near-certain exploitation activity, reflecting that threat actors are actively targeting unpatched Adobe ColdFusion instances with this deserialization vulnerability. While no public exploit code is directly tagged in the NVD references, the confirmed active exploitation and extremely high EPSS score demonstrate that functional exploits are available in the threat landscape. Adobe has published a security bulletin via APSB23-25 with patch information.
Remediation
- Apply vendor mitigations immediately. Follow CISA's required action: apply mitigations per Adobe's instructions as detailed in APSB23-25, or discontinue use of the product if mitigations are unavailable. The CISA remediation deadline was September 11, 2023.
- Upgrade Adobe ColdFusion to a patched version: ColdFusion 2018 should be updated beyond Update 15, and ColdFusion 2021 should be updated beyond Update 5. Apply the latest cumulative updates available from Adobe.
- Implement deserialization defenses by restricting the classes that can be deserialized in ColdFusion, enabling the ColdFusion serialization filter if available, and placing a web application firewall (WAF) in front of ColdFusion servers with rules to detect and block serialized object payloads.
- Restrict network access to ColdFusion administration interfaces and ensure the ColdFusion server is not directly exposed to the internet. Use network segmentation to isolate ColdFusion servers from other critical infrastructure.
- Review server logs for indicators of compromise, including unusual process execution from the ColdFusion service account, unexpected file modifications in the ColdFusion web root, and anomalous outbound network connections that could indicate post-exploitation activity.
Technical Details
CVE-2023-26359 exploits a deserialization of untrusted data weakness (CWE-502) in Adobe ColdFusion's handling of serialized objects. The vulnerability allows an attacker to send specially crafted serialized data to a ColdFusion endpoint, which the application deserializes without proper validation, leading to arbitrary code execution in the context of the current user. As reflected in the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the attack is network-based, trivially exploitable with no authentication or user interaction required, and achieves complete compromise of confidentiality, integrity, and availability. The deserialization flaw is particularly dangerous because it allows attackers to execute arbitrary commands on the underlying operating system through crafted serialized object chains, bypassing application-level security controls entirely.
Frequently Asked Questions
Is CVE-2023-26359 being actively exploited?
Yes, CVE-2023-26359 is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 11, 2023. The EPSS score of 84.7% (99th percentile) confirms widespread exploitation activity targeting Adobe ColdFusion servers.
What products are affected by CVE-2023-26359?
CVE-2023-26359 affects Adobe ColdFusion 2018 Update 15 and earlier, as well as Adobe ColdFusion 2021 Update 5 and earlier. Any organization running these versions of ColdFusion should consider themselves vulnerable and apply patches immediately.
How do I fix CVE-2023-26359?
Apply the security updates provided by Adobe in bulletin APSB23-25. Upgrade ColdFusion 2018 beyond Update 15 and ColdFusion 2021 beyond Update 5. Additionally, implement deserialization defenses, restrict network access to ColdFusion administration, and review server logs for indicators of compromise. See the Remediation section for detailed steps.
How severe is CVE-2023-26359?
CVE-2023-26359 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It ranks in the 99th percentile for exploitation probability (EPSS score of 84.7%). The vulnerability enables arbitrary code execution without authentication, making it one of the most severe types of security flaws.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.