Adobe ColdFusion Vulnerability Could Lead to Arbitrary Code Execution

CVE-2023-26360
8.6HIGH

Key Information

Vendor
Adobe
Status
ColdFusion
Vendor
CVE Published:
23 March 2023

Badges

👾 Exploit Exists🔴 Public PoC🟣 EPSS 96%📰 News Worthy

Summary

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-26360 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

ColdFusion <= unspecified

ColdFusion <= unspecified

ColdFusion <= unspecified

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-26360
Created by yosef0x01

ColdFusion_EXp
Created by CuriousLearnerDev

News Articles

favicon imageHelp Net Security

CISA: Adobe ColdFusion flaw leveraged to access government servers (CVE-2023-26360) - Help Net Security

Unknown attackers have leveraged a critical Adobe ColdFusion vulnerability (CVE-2023-26360) to access US government servers.

9 months ago

EPSS Score

96% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • First article discovered by Help Net Security

  • Vulnerability published.

  • 👾

    Exploit exists.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre DatabaseCISA Database2 Proof of Concept(s)1 News Article(s)
.