CVE-2023-26360: Adobe ColdFusion improper access control enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe vulnerability is in CISA KEV, has public exploit code, a very high EPSS score, and allows unauthenticated remote code execution.

What it is

Adobe ColdFusion 2018 Update 15 and earlier and 2021 Update 5 and earlier contain an improper access control flaw that allows arbitrary code execution in the context of the current user. The issue is remotely reachable without authentication or user interaction, making it a serious risk for internet-facing ColdFusion servers.

Impact

An unauthenticated attacker can execute arbitrary code on the affected server, potentially leading to full compromise of the ColdFusion application and its host. The CVSS vector indicates high confidentiality impact, though integrity and availability impacts are not scored.

Attack surface

The vulnerability is network-reachable (AV:N) with low attack complexity and no privileges or user interaction required (PR:N, UI:N). It can be triggered by sending crafted requests to the ColdFusion service, likely through exposed endpoints.

Exploitation

CVE-2023-26360 is listed in CISA's Known Exploited Vulnerabilities catalog, and public exploit code is referenced. EPSS indicates a very high probability of exploitation activity in the next 30 days.

What to do

• Apply the vendor patch from Adobe security bulletin APSB23-25 immediately.
• If patching is not possible, restrict network access to ColdFusion administrative and application endpoints to trusted sources only.
• Enable and review ColdFusion security settings, including sandbox and access control restrictions.
• Monitor for and block known exploitation attempts using network or host-based signatures.
• Follow CISA KEV required actions and apply updates per vendor instructions by the due date.

Detection

• Monitor ColdFusion server logs for unusual requests, especially those targeting administrative or file-handling endpoints.
• Deploy network signatures to detect known exploit traffic for CVE-2023-26360.
• Hunt for unexpected child processes spawned by the ColdFusion service (e.g., cmd.exe, powershell.exe).
• Review file system and registry changes for signs of post-exploitation activity on ColdFusion hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.