CVE-2023-26359: Adobe ColdFusion untrusted data deserialization allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, network-exploitable without authentication or user interaction, and confirmed in CISA KEV with high EPSS percentile.

What it is

Adobe ColdFusion 2018 Update 15 and earlier and 2021 Update 5 and earlier deserialize untrusted data, which can lead to arbitrary code execution in the context of the current user. The flaw is remotely reachable without authentication or user interaction, making it a serious risk for internet-facing ColdFusion servers.

Impact

An attacker can execute arbitrary code on the server under the ColdFusion process account, potentially leading to full host compromise, data theft, or deployment of additional payloads.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges (PR:N) and no user interaction (UI:N), so any exposed ColdFusion endpoint that processes serialized data can be targeted directly.

Exploitation

CVE-2023-26359 is listed in CISA KEV with a 2023-08-21 addition date, and EPSS shows a 30-day probability of 0.16988 (96.9th percentile), indicating observed exploitation activity. No ransomware campaign use is documented in the record.

What to do

• Apply the vendor patch from Adobe security bulletin APSB23-25 for ColdFusion 2018 and 2021.
• If patching is not immediately possible, follow CISA KEV required actions and vendor mitigations, or discontinue use of the affected product.
• Restrict network access to ColdFusion administrative and application endpoints to trusted sources only.
• Monitor for and block deserialization of untrusted data at the application or WAF layer where feasible.

Detection

• Inspect ColdFusion server and web logs for unexpected POST requests or serialized payloads to ColdFusion endpoints.
• Monitor for child processes spawned by the ColdFusion service account, especially command shells or scripting interpreters.
• Alert on outbound network connections from ColdFusion servers to unusual destinations following suspicious requests.
• Review file system changes in ColdFusion web roots and temporary directories for dropped webshells or payloads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.