CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Adobe ColdFusion Path Traversal Remote Code Execution Vulnerability Urgent Advisory (CVE-2026-48282)
[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier
[Impact] Unauthenticated remote attackers can execute arbitrary code in the context of the current user, with active exploitation confirmed in the wild
[Mitigation] Immediately apply the official Adobe security patches (APSB26-68) and restrict access to sensitive endpoints
Adobe ColdFusion Improper Access Control Vulnerability (CVE-2024-20767) Security Advisory
[Affected Scope] Adobe ColdFusion 2023 Update 6 and earlier, and ColdFusion 2021 Update 12 and earlier
[Impact] Unauthenticated attackers can bypass access controls to read or modify arbitrary files on the host system, potentially exposing sensitive configuration data
[Mitigation] Apply the official Adobe APSB24-14 security patch immediately and restrict external internet access to the ColdFusion administrator panel
Adobe ColdFusion Access Control Bypass and Administrator Endpoint Exposure Vulnerability (CVE-2023-38205) Technical Advisory
[Affected Scope] Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier), and 2023u2 (and earlier)
[Impact] Unauthenticated remote attackers can bypass security filters to access administrative CFM and CFC endpoints, potentially leading to remote code execution (RCE)
[Mitigation] Immediately apply the official Adobe security patch (APSB23-47) and restrict external access to ColdFusion administrator consoles
Adobe ColdFusion Deserialization Remote Code Execution (RCE) Security Advisory (CVE-2023-38203)
[Affected Scope] Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier), and 2023u1 (and earlier)
[Impact] Unauthenticated remote attackers can exploit a Deserialization of Untrusted Data vulnerability (CWE-502) to execute arbitrary code with system privileges
[Mitigation] Immediately apply the official Adobe security patches (APSB23-41), restrict external access, and enable WAF rules
Adobe ColdFusion Untrusted Data Deserialization Vulnerability (CVE-2023-29300) Remote Code Execution (RCE) Security Advisory
[Affected Scope] Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier)
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending malicious serialized data
[Mitigation] Immediately apply the official Adobe security patch (APSB23-40) and restrict external access to serialization endpoints
Adobe ColdFusion Administrator Endpoint Authentication Bypass Vulnerability (CVE-2023-29298) Analysis and Mitigation Guide
[Affected Scope] Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier)
[Impact] Unauthenticated remote attackers can bypass security controls to access administrative CFM and CFC endpoints, potentially leading to full system compromise
[Mitigation] Apply the official Adobe security patches (APSB23-40) immediately and restrict external access to the ColdFusion Administrator interface
Adobe ColdFusion Improper Access Control Remote Code Execution (RCE) Vulnerability (CVE-2023-26360) Security Advisory
[Affected Scope] Adobe ColdFusion 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier)
[Impact] Unauthenticated remote attackers can execute arbitrary code or access sensitive files in the context of the current user without any user interaction
[Mitigation] Immediately apply official vendor patches (ColdFusion 2018 Update 16, ColdFusion 2021 Update 6 or later) and restrict external access
Adobe ColdFusion Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2023-26359) Security Advisory
[Affected Scope] Adobe ColdFusion 2018 Update 15 (and earlier) and ColdFusion 2021 Update 5 (and earlier).
[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without any user interaction.
[Mitigation] Immediately apply the official Adobe security patches to upgrade to ColdFusion 2018 Update 16, ColdFusion 2021 Update 6, or later.
Adobe ColdFusion Apache BlazeDS Java Deserialization Remote Code Execution (CVE-2017-3066)
[Affected Scope] Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier.
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending crafted Action Message Format (AMF) payloads.
[Mitigation] Apply the official Adobe security updates (APSB17-14) immediately and restrict external access to AMF gateway endpoints.