CVE-2021-21307: Lucee Server Admin missing authorization allows unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with CVSS 9.8 and very high EPSS makes this an urgent patch-first issue.

What it is

Lucee Server's Administrator interface before versions 5.3.7.47, 5.3.6.68 and 5.3.5.96 lacks an authorization check (CWE-862), enabling an unauthenticated remote code exploit. Because the flaw is reachable over the network with no credentials or user interaction, it is a critical exposure for any internet- or network-reachable Lucee Administrator.

Impact

An unauthenticated attacker can execute arbitrary code on the Lucee server, gaining full control of the host and its data. CVSS 3.1 scores this 9.8 with high confidentiality, integrity and availability impact.

Attack surface

Reached over the network via the Lucee Administrator (CVSS AV:N/AC:L/PR:N/UI:N), so no authentication or user interaction is required. Public exploit references point to the Administrator's imgProcess.cfm arbitrary file write path.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.89189, 99.77th percentile) and public exploit write-ups and a Packet Storm entry exist, indicating active interest and likely exploitation.

What to do

• Upgrade Lucee to 5.3.7.47, 5.3.6.68 or 5.3.5.96 (or later) immediately.
• If patching is delayed, block access to the Lucee Administrator from untrusted networks as the vendor workaround states.
• Restrict the Administrator to localhost or a management VLAN behind authentication and IP allowlisting.
• Audit for prior compromise (unexpected files, scheduled tasks, modified web content) before and after patching.
• Monitor vendor advisory and commit for any follow-up fixes.

Detection

• Alert on HTTP requests to Lucee Administrator paths, especially imgProcess.cfm, from unexpected source IPs.
• Hunt web/proxy logs for POST or multipart requests to the Administrator from external addresses.
• Monitor for new or modified files in Lucee webroot and scheduled task creation.
• Correlate Lucee process activity spawning shells or unexpected child processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.