CVE-2023-26359

Adobe ColdFusion 2018 (Update 15 and earlier) and 2021 (Update 5 and earlier) contain a deserialization of untrusted data flaw (CWE-502) that an unauthenticated attacker can trigger remotely by sending untrusted input that the server deserializes, with no user interaction or privileges required. Successful exploitation results in arbitrary code execution in the context of the current user, letting the attacker run code with the privileges of the ColdFusion process. Any organization running an affected release is exposed, particularly where ColdFusion is reachable from the internet as a web application server. The flaw carries a CVSS 3.1 score of 9.8 (critical) and an EPSS score of 17.0% probability of exploitation within 30 days (97th percentile), and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-08-21. News coverage tied to the KEV addition reports the flaw is under active exploit, with thousands of ColdFusion exploitation attempts observed in the wild, including a surge during the Christmas holiday period.

What to do: Upgrade ColdFusion 2018 to an update later than Update 15 and ColdFusion 2021 to an update later than Update 5 per Adobe's security advisory; if immediate patching is not possible, apply Adobe's recommended mitigations or discontinue use of the product, per CISA's KEV required action. Prioritize internet-facing ColdFusion instances and review access and application logs for signs of exploitation or post-exploitation activity, since active exploitation and mass scanning of ColdFusion servers have been reported.