CVE-2022-38421: Adobe ColdFusion path traversal allows arbitrary code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 7.2 with high EPSS and code execution impact, tempered by the administrator privilege requirement and absence of KEV listing.

What it is

Adobe ColdFusion is affected by a path traversal flaw (CWE-22) that lets a pathname escape its restricted directory. Successful exploitation results in arbitrary code execution in the context of the current user. The issue affects Update 14 and earlier and Update 4 and earlier.

Impact

An attacker gains arbitrary code execution under the ColdFusion process account, which can lead to full compromise of the server and its data. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network (AV:N) with no user interaction (UI:N), but it requires administrator privileges (PR:H), so the attacker must already hold an admin-level account or session. No other preconditions are stated in the record.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at 0.792 (99.6th percentile), indicating strong likelihood of attempted exploitation. The only references are Adobe's patch advisory, so no public exploit details are confirmed in this record.

What to do

• Apply the Adobe ColdFusion update referenced in advisory APSB22-44 (Update 15 / Update 5 or later) as the first action.
• Restrict and audit administrator accounts on ColdFusion servers; enforce least privilege and remove unused admin access.
• Limit network exposure of ColdFusion administrative interfaces to trusted management networks.
• Monitor and review ColdFusion administrator activity and file system writes for unexpected paths.

Detection

• Alert on ColdFusion process writes or reads involving paths that traverse outside expected web or application directories.
• Monitor administrator logins and admin console actions for unusual timing or source IPs.
• Watch for new or modified executable files, JSP/CFM files or scheduled tasks created by the ColdFusion service account.
• Correlate ColdFusion server logs with outbound network connections from the host that may indicate post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.