CVE-2018-15961: Adobe ColdFusion unrestricted file upload leads to code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a near-maximum EPSS score, a public exploit, and confirmed inclusion in CISA KEV.

What it is

Adobe ColdFusion (July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier) allows unrestricted file uploads. An uploaded file can be placed and executed, giving arbitrary code execution on the server. The flaw is remotely reachable without authentication or user interaction, making it a severe risk for exposed ColdFusion instances.

Impact

An attacker gains arbitrary code execution in the context of the ColdFusion server process, which can lead to full server compromise, data theft, and use of the host as a foothold.

Attack surface

Reachable over the network via the ColdFusion web interface; the CVSS vector shows no privileges required and no user interaction, so an unauthenticated remote attacker can attempt it directly.

Exploitation

Listed in CISA KEV since 2021-11-03 with a required action to apply vendor updates, and EPSS is near the top of the distribution (0.9995, 99.973rd percentile). A public Exploit-DB entry (45979) exists, so exploitation is practical and observed.

What to do

• Apply the Adobe ColdFusion update referenced in advisory APSB18-33 (or later) to all affected installations.
• If patching cannot be done immediately, restrict network access to ColdFusion administrative and upload endpoints to trusted hosts only.
• Disable or remove unused upload functionality and validate file types and extensions on the server side.
• Run ColdFusion with least privilege and isolate it from sensitive internal systems.
• Monitor for unexpected files written to web-accessible directories and remove any found.

Detection

• Alert on new or modified executable files (for example .jsp, .cfm, .jspx) appearing in ColdFusion web roots or upload directories.
• Review web server and ColdFusion logs for POST requests to upload endpoints followed by requests to the uploaded file.
• Hunt for outbound connections or child processes spawned by the ColdFusion service that are unusual for the environment.
• Correlate file-write events in ColdFusion directories with subsequent process creation on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.