Vulnerabilityhigh
Thousands of ColdFusion exploit attempts spotted during Christmas holiday
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2023-44353+2 related CVEs | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result… | 9.8 group max | 80% | ||
| CVE-2023-26359 | Unauthenticated Deserialization RCE in Adobe ColdFusion 2018 and 2021 | 9.8 | 17% | KEV | KEV |
CVE-2023-29300+1 related CVE | Deserialization of Untrusted Data RCE in Adobe ColdFusion (CVE-2023-29300) | 9.8 group max | 100% | KEVRansomware | KEV |
| CVE-2023-38203 | Unauthenticated Deserialization RCE in Adobe ColdFusion (Actively Exploited) | 9.8 | 97% | KEVRansomware | KEV |
CVE-2023-38205+1 related CVE | Security Feature Bypass in Adobe ColdFusion Exposes Admin CFM/CFC Endpoints | 7.5 group max | 100% | KEV | KEV |
| CVE-2024-20767 | Improper Access Control in Adobe ColdFusion Enables Arbitrary File Read | 7.4 | 99% | KEV | KEV |
From the original article
2 min read at securityaffairs.com
GreyNoise observed thousands of attacks targeting about a dozen Adobe ColdFusion vulnerabilities during the Christmas 2025 holiday. GreyNoise reports a coordinated campaign exploiting about a dozen Adobe ColdFusion vulnerabilities, with thousands of attack attempts observed during the Christmas 2025 holiday.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.