Adobe warns customers of critical ColdFusion RCE exploited in attacks

CVE-2023-26360 is an improper access control flaw (CISA categorizes it as deserialization of untrusted data) in Adobe ColdFusion 2018 (Update 15 and earlier) and ColdFusion 2021 (Update 5 and earlier). It can be triggered over the network with no authentication and no user interaction. A successful attacker achieves arbitrary code execution in the context of the current user, giving them full control of the ColdFusion server. Any organization running the affected ColdFusion versions is exposed, particularly those with instances reachable from the internet; public reporting confirms exploitation in the wild, including a breach of federal agency servers. The flaw was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-15, has a public proof-of-concept, and carries a 97.3% EPSS probability of exploitation within 30 days.

Do: Apply Adobe's updates per vendor instructions, upgrading ColdFusion 2018 beyond Update 15 and ColdFusion 2021 beyond Update 5. Because exploitation is unauthenticated and confirmed in the wild (including against a federal agency), prioritize patching internet-facing servers, restrict ColdFusion endpoints to trusted networks in the interim, and hunt for signs of compromise such as web shells, unexpected processes, and suspicious connections (reported activity includes malicious web shell use). Organizations that cannot patch immediately should at minimum limit exposure and monitor for exploitation attempts.

Adobe ColdFusion contains a deserialization of untrusted data flaw (CWE-502): the application deserializes attacker-supplied, untrusted serialized data without adequate validation, allowing an attacker to trigger code execution on the ColdFusion server. Successful exploitation yields arbitrary code execution in the context of the running ColdFusion server, a foothold that can be leveraged for further compromise and, per CISA, ransomware deployment. Any organization running Adobe ColdFusion is affected, especially internet-facing instances; the CISA data does not enumerate specific affected version ranges, so operators should consult Adobe's advisory for the exact affected and fixed releases. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-08 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile); no public PoC is known, but the KEV listing and ransomware usage confirm active in-the-wild exploitation.

Do: Patch every ColdFusion instance with the updates from Adobe's security advisory (APSB23-52), which satisfies the CISA required action to apply vendor mitigations or discontinue use of the product if mitigations are unavailable; prioritize internet-facing servers. If patching must be delayed, restrict network access to the ColdFusion server per vendor guidance and review logs for signs of exploitation or ransomware activity.