CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Adobe ColdFusion Path Traversal Remote Code Execution Vulnerability Urgent Advisory (CVE-2026-48282)
[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier
[Impact] Unauthenticated remote attackers can execute arbitrary code in the context of the current user, with active exploitation confirmed in the wild
[Mitigation] Immediately apply the official Adobe security patches (APSB26-68) and restrict access to sensitive endpoints
Adobe ColdFusion Deserialization Remote Code Execution (RCE) Security Advisory (CVE-2023-38203)
[Affected Scope] Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier), and 2023u1 (and earlier)
[Impact] Unauthenticated remote attackers can exploit a Deserialization of Untrusted Data vulnerability (CWE-502) to execute arbitrary code with system privileges
[Mitigation] Immediately apply the official Adobe security patches (APSB23-41), restrict external access, and enable WAF rules
Adobe ColdFusion Untrusted Data Deserialization Vulnerability (CVE-2023-29300) Remote Code Execution (RCE) Security Advisory
[Affected Scope] Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier)
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending malicious serialized data
[Mitigation] Immediately apply the official Adobe security patch (APSB23-40) and restrict external access to serialization endpoints
Adobe ColdFusion Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2023-26359) Security Advisory
[Affected Scope] Adobe ColdFusion 2018 Update 15 (and earlier) and ColdFusion 2021 Update 5 (and earlier).
[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without any user interaction.
[Mitigation] Immediately apply the official Adobe security patches to upgrade to ColdFusion 2018 Update 16, ColdFusion 2021 Update 6, or later.
Adobe ColdFusion Unrestricted File Upload Vulnerability (CVE-2018-15961) Remote Code Execution (RCE) Analysis and Mitigation Guide
[Affected Scope] Adobe ColdFusion 2018 (Release 2018.0.0.310739 and earlier), ColdFusion 2016 Update 6 and earlier, and ColdFusion 11 Update 14 and earlier
[Impact] Unauthenticated remote attackers can upload arbitrary executable files (such as .jsp) and execute them directly to achieve Remote Code Execution (RCE) with system privileges
[Mitigation] Immediately apply the official Adobe security patch (APSB18-33) and restrict execution permissions on publicly accessible upload directories
Adobe ColdFusion Deserialization Remote Code Execution (RCE) Security Advisory (CVE-2018-4939)
[Affected Scope] Adobe ColdFusion 2016 Update 5 and earlier, ColdFusion 11 Update 13 and earlier
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting a deserialization of untrusted data (CWE-502)
[Mitigation] Immediately apply the official Adobe security patch (APSB18-14) and restrict external access to RMI and management ports
Adobe ColdFusion Apache BlazeDS Java Deserialization Remote Code Execution (CVE-2017-3066)
[Affected Scope] Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier.
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending crafted Action Message Format (AMF) payloads.
[Mitigation] Apply the official Adobe security updates (APSB17-14) immediately and restrict external access to AMF gateway endpoints.
Adobe ColdFusion RDS Default Password Authentication Bypass and Remote Code Execution (CVE-2013-0632)
[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10
[Impact] Remote attackers can bypass authentication using a default empty password on the RDS component, hijack the session to access the administrator interface, and execute arbitrary code
[Mitigation] Apply the official APSB13-03 security patch, disable the RDS component, or enforce strong passwords
Adobe ColdFusion Authentication Bypass and Remote Code Execution Vulnerability (CVE-2013-0625) Advisory
[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, and 9.0.2 when an administrator password is not configured
[Impact] Remote attackers can bypass authentication, gain administrative access, and potentially execute arbitrary code to compromise the server
[Mitigation] Apply the official Adobe security patch (APSB13-03), enforce strong administrator passwords, and restrict external access to the admin console
Adobe ColdFusion Administrator Console Directory Traversal LFI Vulnerability (CVE-2010-2861)
[Affected Scope] Adobe ColdFusion 9.0.1 and earlier versions containing the CFIDE/administrator console
[Impact] Unauthenticated remote attackers can exploit directory traversal to read arbitrary system and configuration files, potentially retrieving administrator password hashes and fully compromising the server
[Mitigation] Apply the official APSB10-18 security patch, restrict external access to the CFIDE directory, or upgrade to a supported secure version