CVE-2013-0632: Adobe ColdFusion RDS default password authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, active exploitation in the wild, CISA KEV listing and a very high EPSS probability make this an urgent patch-first issue.

What it is

Adobe ColdFusion 9.0 through 10 ships administrator.cfc with an RDS component that accepts a default empty password. An attacker can log in to RDS with that empty password and use the resulting session to reach the administrative web interface, bypassing authentication entirely. The flaw was exploited in the wild in January 2013 and is listed in CISA KEV.

Impact

An attacker gains administrative access to the ColdFusion server and, per the description, may execute arbitrary code. This yields full compromise of confidentiality, integrity and availability of the host.

Attack surface

Reachable over the network via the RDS component and administrative web interface; no authentication is required because the default empty password is accepted, and no user interaction is needed. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N.

Exploitation

CISA KEV lists it as exploited in the wild (added 2022-03-03), EPSS 30-day probability is 0.93691 (99.8th percentile), and a public Exploit-DB entry (30210) exists. No ransomware campaign use is documented.

What to do

• Apply the Adobe vendor update per APSB13-03/APSA13-01 instructions; upgrade off the affected ColdFusion 9.x and 10 releases.
• Set a strong non-empty RDS password and disable the RDS service if it is not required.
• Restrict network access to the ColdFusion administrator interface and RDS ports to trusted management hosts only.
• Audit ColdFusion administrator accounts and sessions for unauthorized changes or additions.
• If patching is delayed, isolate the ColdFusion host from untrusted networks.

Detection

• Review ColdFusion and web server logs for RDS logins using an empty or default password, especially from unexpected source IPs.
• Alert on access to administrator.cfc and the ColdFusion administrative interface from non-management networks.
• Monitor for new or modified ColdFusion administrator accounts, scheduled tasks, or datasources that follow an RDS login.
• Hunt for post-exploitation activity such as unexpected child processes spawned by the ColdFusion service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.