Adobe ColdFusion Improper Access Control Arbitrary code execution (CVE-2023-26360)

What is affected, what to do

The vulnerability CVE-2023-26360 allows for remote code execution (RCE) via deserialization of untrusted data in Adobe ColdFusion. An attacker can execute arbitrary code in the context of the current user without user interaction or authentication. The vulnerability is actively exploited and is listed in the CISA KEV catalog. Affected are Adobe ColdFusion versions 2018 Update 15 and earlier, and 2021 Update 5 and earlier. Immediate patching to the latest version is urgently required.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Adobe ColdFusion eq 2018..2018
• Adobe ColdFusion eq 2021..2021

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Deploy the Adobe patches: ColdFusion 2018 Update 16 (APSB23-25) and ColdFusion 2021 Update 6; bring ColdFusion 2023 to the latest update as well. Restart the ColdFusion service and verify administrator login after patching.
   • Inventory exposure: enumerate every ColdFusion instance reachable from the internet on TCP/80, /443, /8500 and /8300 using internal masscan/nmap sweeps. Patch internet-facing hosts first, internal hosts second.
   • If the patch cannot land within 24 h, block external access to /CFIDE/administrator/, /CFIDE/adminapi/ and /cf_scripts/ at the reverse proxy or WAF; only allow a dedicated admin jump host.
   • Perform a compromise check BEFORE patching: look for unknown .cfm, .cfml, .jsp files under the webroot and cfusion/wwwroot/CFIDE/ dated after 1 February 2023 (find … -newermt 2023-02-01 -name "*.cfm"). Preserve suspicious files for forensics, do not delete.
   • Rotate service credentials: if ColdFusion runs under a domain account or stores datasource secrets in neo-datasource.xml, rotate all database, SMTP and administrator passwords after patching — anyone with RCE already had access to them.
   • Tighten egress: restrict outbound connections from the ColdFusion host to the datasources, SMTP and update servers it actually needs; specifically block arbitrary outbound 443/80 to cloud hosters and the usual reverse-shell ports (4444, 8080).
2. 02

   Runbook step 2

   Mitigation layers

   • Network: place the ColdFusion admin interface on a management VLAN, accessible only via VPN or jump host. Terminate HTTP on a reverse proxy (nginx, Apache, F5) in front of ColdFusion and whitelist the actual application paths — everything matching /CFIDE/administrator* and /CFIDE/adminapi* returns 403 externally.
   • WAF rule: block HTTP requests hitting the ColdFusion admin paths above, requests with ?locale= abuse patterns, and payloads carrying Java-serialisation markers (rO0AB, aced0005) in body or query. Enable ModSecurity CRS rule families 942/943 and raise paranoia level.
   • Endpoint hardening: run the ColdFusion service under a dedicated, non-privileged account (never LocalSystem or root). On Windows add an AppLocker rule preventing cfusion\jre\bin\java.exe from spawning cmd.exe, powershell.exe or rundll32.exe. On Linux apply an SELinux or AppArmor profile denying exec from the coldfusion domain.
   • Configuration hardening per the Adobe ColdFusion Lockdown Guide: disable Robust Exception Information, enable Sandbox Security, disable or rename unused CFIDE services such as /CFIDE/componentutils/ and /CFIDE/scripts/.
   • IAM: rotate the ColdFusion administrator password and the RDS password, and disable RDS entirely if not needed. Grant datasource accounts least privilege at the DBMS (no xp_cmdshell, no FILE privilege).
   • Backup and recovery: capture an offline snapshot of the web application and its database as a rollback point before applying the patch — if a webshell is already persisted, patching alone will not evict the intruder.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: POST or GET requests to /CFIDE/administrator/, /CFIDE/adminapi/administrator.cfc, /CFIDE/wizards/common/_logintowizard.cfm from external source IPs returning HTTP 200. Sigma shape: selection: cs-uri-stem|contains: '/CFIDE/adminapi/' combined with sc-status: 200 and c-ip not in internal_admin_range.
   • Process ancestry (Sysmon EID 1 / EDR): coldfusion.exe, jrun.exe or the ColdFusion java.exe spawning cmd.exe, powershell.exe, whoami.exe, net.exe, certutil.exe or bitsadmin.exe. KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ('coldfusion.exe','java.exe') and FileName in~ ('cmd.exe','powershell.exe','whoami.exe').
   • File system (Sysmon EID 11 / auditd watch on CFIDE directories): new .cfm, .cfml, .jsp or .class files appearing in wwwroot\CFIDE\, cfusion\wwwroot\, /opt/coldfusion*/cfusion/wwwroot/. Flag names that look random, e.g. [a-z0-9]{6,12}\.cfm.
   • Network telemetry (Zeek, Suricata): outbound connections from the ColdFusion host to non-standard ports (4444, 8080, 1337, 9001) or to pastebin and dynamic-DNS targets within ten minutes after any POST to /CFIDE/.
   • IOC file carving: hunt for the webshells observed in CVE-2023-26360 campaigns — files such as hub.cfm, verify.cfm, test.cfm containing cfexecute tags or java.lang.Runtime.getRuntime().exec calls inside CFIDE directories.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Source: CSA/SingCERT, pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Adobe Adobe ColdFusion

Weakness classes (CWE)

• CWE-284Improper Access Control

  Pillar

  The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

  Entry at MITRE CWE-284

References & sources

• helpx.adobe.comVendor advisory: Adobe ColdFusionPatch, Vendor advisory, pwn-watch
• packetstormsecurity.comfiles/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execu…Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360government-resource, Third-party advisory, US government resource
• pwn.watchpwn.watch: Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360)pwn-watch
• NVD (NIST)NVD: CVE-2023-26360pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch