Loading story…
Adobe reported active exploitation of four critical vulnerabilities in ColdFusion affecting Windows, Macintosh, and UNIX systems. Advisory APSA13-01, issued in January 2013, identified CVE-2013-0625 and CVE-2013-0632 as remote authentication-bypass flaws that could enable server takeover, CVE-2013-0629 as a restricted-directory access vulnerability, and CVE-2013-0631 as an information-disclosure flaw involving a compromised server. The CVE record for CVE-2013-0629 specifies that ColdFusion 9.0, 9.0.1, 9.0.2, and 10 are vulnerable when a password is not configured and confirms exploitation in January 2013.
Adobe released priority 1 security hotfixes for ColdFusion 10, 9.0.2, 9.0.1, and 9.0, with installation instructions in bulletin APSB13-03. Administrators should apply the applicable fixes and restrict administrative access. For unsupported versions, including ColdFusion 8.x and earlier, Adobe recommended configuring password protection, disabling Remote Development Services after setting credentials, restricting administrative access, and removing unknown or unnecessary components.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
CISA added Adobe ColdFusion authentication-bypass vulnerability CVE-2013-0632 to its Known Exploited Vulnerabilities Catalog. It required vendor-directed updates with a remediation deadline of March 24, 2022.
The published CVE record documented restricted-directory access in ColdFusion 9.0, 9.0.1, 9.0.2, and 10 when a password is not configured. It also identified exploitation in the wild.
Adobe released APSA13-01 warning of critical ColdFusion vulnerabilities and exploitation in the wild against customers. The advisory provided mitigation guidance, including password protections and restrictions on administrative access.
CVE-2013-0629 was exploited in the wild against Adobe ColdFusion in January 2013. The vulnerability allows attackers to access restricted directories when a password is not configured.
An Exploit-DB entry documents a Metasploit exploit for remote administrative authentication bypass in Adobe ColdFusion 9.
Adobe revised APSA13-01 to correct the ColdFusion versions vulnerable to CVE-2013-0625. The corrected affected-version list identified ColdFusion 9.0.2, 9.0.1, and 9.0.
Adobe updated APSA13-01 with information about security hotfixes for ColdFusion 10, 9.0.2, 9.0.1, and 9.0. The fixes addressed critical vulnerabilities, received priority rating 1, and were accompanied by installation instructions in APSB13-03.
Adobe updated APSA13-01 to identify CVE-2013-0632 as being exploited in the wild. The vulnerability could allow remote authentication bypass and potential takeover of ColdFusion 10 and supported ColdFusion 9 releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourceweb.nvd.nist.gov
Open sourceexploit-db.com
Open sourceadobe.com
Open sourceadobe.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe issued urgent ColdFusion updates after multiple severe vulnerabilities were disclosed across ColdFusion 2025 and 2023, including several flaws that can lead to arbitrary code execution. The most serious newly listed issue, **CVE-2026-48362**, is an unauthenticated OS command injection bug rated `CVSS 10.0`, while **CVE-2026-48273** was rated `9.9` for eval injection. Additional high-severity flaws include **CVE-2026-71387** (incorrect authorization, `CVSS 8.8`) and **CVE-2026-71386** (cross-site scripting, `CVSS 8.8`), alongside other issues affecting authorization, memory safety, denial of service, and sensitive memory exposure. Adobe said affected versions include ColdFusion 2025 up to `2025.0.11` and ColdFusion 2023 up to `2023.0.22`, and directed customers to upgrade to **2025.0.12** or **2023.0.23**. The warnings follow earlier reports that attackers rapidly exploited at least one maximum-severity ColdFusion flaw, **CVE-2026-48282**, a path traversal vulnerability that can enable arbitrary code execution without user interaction. Researchers said exploitation began within hours of public disclosure, and Shadowserver data cited **775** internet-exposed ColdFusion instances, highlighting the reachable attack surface. Adobe said it had not observed active exploitation of the latest August issues, but advised administrators to patch immediately, restrict access to the administrative network zone and portal, limit network exposure, monitor logs for unauthorized access attempts, and accelerate remediation as ColdFusion remains a high-value target.
Aug 12, 2026
Adobe released security updates for 12 products, fixing 88 vulnerabilities across its portfolio, with the most urgent issues affecting **ColdFusion**. The ColdFusion advisory was rated **Priority 1** and addresses 13 flaws, including eight critical vulnerabilities that could allow **arbitrary code execution** or **privilege escalation** through path traversal, code injection, improper input validation, missing authentication, SQL injection, and incorrect authorization. The fixes are included in **ColdFusion 2025 Update 11** and **ColdFusion 2023 Update 22**. Adobe also patched critical vulnerabilities in **Commerce**, **Experience Manager**, and **Illustrator**, and said it is not aware of any of the newly addressed vulnerabilities being exploited in the wild.
Jul 15, 2026
Adobe disclosed two high-severity vulnerabilities in **ColdFusion** that affect versions **2023.18, 2025.6, and earlier**. The first, `CVE-2026-27304`, is an improper input validation flaw (`CWE-20`) that can lead to **arbitrary code execution** in the context of the current user without requiring user interaction. Adobe assigned the issue a CVSS v3.1 vector of `AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N` and published details in security bulletin **APSB26-38**. Adobe also disclosed `CVE-2026-27305`, a **path traversal** vulnerability (`CWE-22`) in the same ColdFusion versions that allows an unauthenticated remote attacker to perform **arbitrary file system reads** and access sensitive files outside intended directories. The flaw likewise requires no user interaction and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`, making the pair of issues a significant risk for exposed ColdFusion deployments.
Jun 30, 2026