CVE-2023-26359Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
Updated under an hour ago ()
Does this affect you?
It affects Adobe ColdFusion. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Aug 21, 2023; federal agencies had to remediate by Sep 11, 2023. Treat that date as your deadline.
Do this next
Free account, 1 product
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-502
- Known exploited
- Added to CISA KEV Aug 21, 2023; federal remediation due Sep 11, 2023Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 16.99% (percentile 97)
- Assigned by
- adobe
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Adobe ColdFusion adobe:coldfusion (from the name) | from unspecified through CF2018U15, CF2021U5; from unspecified through None | CNA record |
adobe coldfusion adobe:coldfusion | 2018; 2018; 2018; 2018; 2018; 2018; 2018; 2018; and 14 more ranges | NVD |
References
- https://helpx.adobe.com/security/products/coldfusion/apsb23-25.htmlpatch, vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26359third-party-advisory, us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.