Loading story…
Attackers exploited Adobe ColdFusion vulnerabilities that can allow arbitrary code execution without user interaction. Adobe confirmed limited exploitation of CVE-2023-26360 in March 2023, and FortiGuard Labs subsequently reported blocking several hundred attempts targeting the flaw. FortiGuard identified both CVE-2023-26360 and CVE-2023-26359 as deserialization vulnerabilities and reported that CISA added both to its Known Exploited Vulnerabilities catalog. A separate SecureLayer7 analysis reported CVE-2023-26360 exploitation against U.S. Federal Civilian Executive Branch agencies and, citing Threatrecon, attributed exploitation to the Chinese government-sponsored group SectorB01.
CVE-2023-26360 affects ColdFusion 2018 and 2021, enabling unauthenticated attackers to read arbitrary files and execute code. SecureLayer7 traced the issue to unsafe handling of attacker-controlled JSON metadata, allowing arbitrary file paths to reach ColdFusion’s template-loading and compilation mechanisms. Its demonstrated execution chain placed a ColdFusion execution tag in a log file, then caused the server to process that file. Patch analysis identified a new allowNonCFCDeserialization control intended to restrict the unsafe behavior. Organizations should prioritize Adobe’s security updates and investigate signs of compromise on exposed servers; FortiGuard reported that IPS protection for CVE-2023-26359 remained under investigation at the time of its alert.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
CISA added the ColdFusion deserialization vulnerability CVE-2023-26359 to its Known Exploited Vulnerabilities catalog.
FortiGuard added an intrusion prevention signature to detect exploitation attempts targeting CVE-2023-26360.
CISA added the exploited ColdFusion vulnerability CVE-2023-26360 to its Known Exploited Vulnerabilities catalog.
FortiGuard Labs published a Threat Signal report concerning the ColdFusion vulnerability CVE-2023-26360.
Adobe released security advisory APSB23-25 and confirmed that CVE-2023-26360 had been exploited in very limited attacks against ColdFusion. The reported vulnerabilities could allow arbitrary code execution without user interaction.
Adobe published March 2023 security updates for ColdFusion 2018 and 2021 addressing the reported vulnerabilities.
A researcher reproduced arbitrary file reads and remote code execution by manipulating JSON metadata and causing ColdFusion to compile attacker-influenced log content. Patch analysis identified a new allowNonCFCDeserialization control intended to restrict the vulnerable behavior.
SecureLayer7 cited Threatrecon as attributing exploitation to SectorB01, described as a Chinese government-sponsored advanced persistent threat group.
SecureLayer7 reported that threat actors exploited CVE-2023-26360 to gain initial access to U.S. Federal Civilian Executive Branch agencies, citing CISA advisory AA23-339A.
FortiGuard Labs reported continued targeted attacks against CVE-2023-26360, with its IPS devices blocking several hundred exploitation attempts during the month preceding its report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited Adobe ColdFusion vulnerabilities by chaining an access-control bypass, **CVE-2023-29298**, with a deserialization flaw, **CVE-2023-38203**, to achieve remote code execution. Rapid7 observed attacks in multiple customer environments beginning July 13, 2023. An exploit published and subsequently removed by Project Discovery apparently exposed a new zero-day rather than the previously patched CVE-2023-29300. Adobe patched CVE-2023-38203 on July 14, but Rapid7 confirmed that the original CVE-2023-29298 fix remained bypassable. Adobe addressed that remaining bypass as **CVE-2023-38205** on July 19, and Rapid7 verified that the new patch worked. FortiGuard Labs subsequently reported more than **50,000 unique IPS detections on January 9, 2024**, highlighting widespread exploitation attempts involving ColdFusion vulnerabilities, including CVE-2023-26347; successful access-control bypasses could expose ColdFusion Administrator endpoints. CVE-2023-29298, CVE-2023-38203 and CVE-2023-38205 are listed in CISA’s Known Exploited Vulnerabilities catalog. Observed attackers used encoded PowerShell to create a ColdFusion webshell, make outbound requests and conduct domain-trust discovery. Organizations should apply Adobe’s vendor-recommended security updates, restrict access to administrative endpoints and investigate suspected webshell activity; Rapid7 also recommended blocking oastify[.]com.
Oct 9, 2026
Adobe issued urgent ColdFusion updates after multiple severe vulnerabilities were disclosed across ColdFusion 2025 and 2023, including several flaws that can lead to arbitrary code execution. The most serious newly listed issue, **CVE-2026-48362**, is an unauthenticated OS command injection bug rated `CVSS 10.0`, while **CVE-2026-48273** was rated `9.9` for eval injection. Additional high-severity flaws include **CVE-2026-71387** (incorrect authorization, `CVSS 8.8`) and **CVE-2026-71386** (cross-site scripting, `CVSS 8.8`), alongside other issues affecting authorization, memory safety, denial of service, and sensitive memory exposure. Adobe said affected versions include ColdFusion 2025 up to `2025.0.11` and ColdFusion 2023 up to `2023.0.22`, and directed customers to upgrade to **2025.0.12** or **2023.0.23**. The warnings follow earlier reports that attackers rapidly exploited at least one maximum-severity ColdFusion flaw, **CVE-2026-48282**, a path traversal vulnerability that can enable arbitrary code execution without user interaction. Researchers said exploitation began within hours of public disclosure, and Shadowserver data cited **775** internet-exposed ColdFusion instances, highlighting the reachable attack surface. Adobe said it had not observed active exploitation of the latest August issues, but advised administrators to patch immediately, restrict access to the administrative network zone and portal, limit network exposure, monitor logs for unauthorized access attempts, and accelerate remediation as ColdFusion remains a high-value target.
Aug 12, 2026
Adobe disclosed two high-severity vulnerabilities in **ColdFusion** that affect versions **2023.18, 2025.6, and earlier**. The first, `CVE-2026-27304`, is an improper input validation flaw (`CWE-20`) that can lead to **arbitrary code execution** in the context of the current user without requiring user interaction. Adobe assigned the issue a CVSS v3.1 vector of `AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N` and published details in security bulletin **APSB26-38**. Adobe also disclosed `CVE-2026-27305`, a **path traversal** vulnerability (`CWE-22`) in the same ColdFusion versions that allows an unauthenticated remote attacker to perform **arbitrary file system reads** and access sensitive files outside intended directories. The flaw likewise requires no user interaction and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`, making the pair of issues a significant risk for exposed ColdFusion deployments.
Jun 30, 2026