CVE-2023-26360
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Description
CVE-2023-26360 is an improper access control vulnerability in Adobe ColdFusion that can lead to arbitrary code execution. The flaw affects Adobe ColdFusion 2018 Update 15 and earlier, as well as ColdFusion 2021 Update 5 and earlier, allowing attackers to execute arbitrary code in the context of the current user without any user interaction. This Adobe ColdFusion vulnerability carries a CVSS score of 8.6 (High) and has been added to CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 94.33%, CVE-2023-26360 represents an extremely high probability of exploitation, making immediate remediation essential for any organization running affected ColdFusion versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | coldfusion | 2018; 2021 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360(Third Party Advisory, US Government Resource)
Weakness Type
CWE-284: Improper Access Control
Adobe ColdFusion fails to properly restrict access to certain functionality, enabling unauthenticated attackers to bypass intended security controls and achieve arbitrary code execution. This improper access control weakness means that the application does not adequately enforce authorization checks, allowing unauthorized users to reach sensitive code paths that should be restricted.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2023-26360 poses a severe security risk to organizations running Adobe ColdFusion. Attack Vector (Network): The vulnerability is remotely exploitable without requiring physical access to the target system, significantly expanding the potential attack surface. Attack Complexity (Low): Exploitation is straightforward and does not require special conditions or advanced techniques. Privileges Required (None): An attacker needs no authentication or prior access to exploit this flaw, making it accessible to any remote threat actor. User Interaction (None): No action from a legitimate user is needed to trigger the vulnerability. Scope (Changed): The vulnerability can affect resources beyond the ColdFusion application itself, potentially compromising the underlying server infrastructure. Confidentiality (High): Successful exploitation can expose highly sensitive data processed by or accessible through the ColdFusion server. With a CVSS score of 8.6 and an EPSS score at the 99.95th percentile, this vulnerability represents one of the most likely-to-be-exploited flaws in the current threat landscape.
Exploit Maturity
Public exploit code is available for CVE-2023-26360 via Packet Storm Security, providing attackers with ready-to-use unauthenticated remote code execution capabilities against Adobe ColdFusion. Active exploitation has been confirmed by CISA, which added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 5, 2023. The EPSS score of 94.33% places CVE-2023-26360 at the 99.95th percentile, indicating near-certain exploitation activity in the wild. Organizations that have not yet patched their ColdFusion installations should treat this as an emergency requiring immediate action.
Remediation
- Apply vendor patches immediately — Adobe has released security updates addressing CVE-2023-26360. Upgrade ColdFusion 2018 to Update 16 or later, and ColdFusion 2021 to Update 6 or later, as detailed in Adobe Security Bulletin APSB23-25. Per CISA's directive, apply mitigations or discontinue use if patches are unavailable.
- Restrict network access to ColdFusion — Place ColdFusion servers behind a web application firewall (WAF) and limit inbound access to only trusted IP ranges. Block direct internet exposure of ColdFusion administration panels.
- Implement strict access controls — Review and tighten authorization policies on ColdFusion endpoints to ensure that only authenticated and authorized users can reach sensitive functionality. Disable unnecessary ColdFusion features and endpoints.
- Monitor for indicators of compromise — Review ColdFusion server logs for unusual access patterns, unexpected file modifications, or signs of webshell deployment. Check for unauthorized processes running under the ColdFusion service account.
- Harden ColdFusion deployments — Enable lockdown mode in ColdFusion, apply the principle of least privilege to ColdFusion service accounts, and ensure the underlying operating system is fully patched. Regularly audit access control configurations to prevent similar improper access control issues.
Technical Details
CVE-2023-26360 exploits an improper access control weakness (CWE-284) in Adobe ColdFusion's request handling mechanism. The vulnerability allows unauthenticated remote attackers to bypass access restrictions and execute arbitrary code in the context of the ColdFusion application user. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates a network-accessible attack with low complexity that requires no privileges or user interaction, with a changed scope meaning the exploitation can impact components beyond the vulnerable ColdFusion instance. The primary impact is on confidentiality, rated as High, suggesting that attackers can access sensitive data through the ColdFusion server. The vulnerability stems from ColdFusion's failure to properly validate and enforce authorization checks on incoming requests, allowing unauthenticated users to access functionality that should be restricted to privileged users only.
Frequently Asked Questions
Is CVE-2023-26360 being actively exploited?
Yes, CVE-2023-26360 is being actively exploited in the wild. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 5, 2023. The EPSS score of 94.33% further confirms widespread exploitation activity.
What products are affected by CVE-2023-26360?
CVE-2023-26360 affects Adobe ColdFusion 2018 Update 15 and earlier versions, as well as Adobe ColdFusion 2021 Update 5 and earlier versions. All deployments of these ColdFusion versions are vulnerable regardless of configuration.
How do I fix CVE-2023-26360?
To remediate CVE-2023-26360, upgrade Adobe ColdFusion 2018 to Update 16 or later, and ColdFusion 2021 to Update 6 or later. Apply the patches from Adobe Security Bulletin APSB23-25 immediately and restrict network access to ColdFusion servers. See the Remediation section for detailed steps.
How severe is CVE-2023-26360?
CVE-2023-26360 is rated High severity with a CVSS score of 8.6 out of 10. It sits at the 99.95th EPSS percentile, meaning it is among the most actively exploited vulnerabilities tracked. The combination of remote exploitability, no authentication requirement, and confirmed active exploitation makes this a critical priority for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.