ColdFusion

Security incidents tagged ColdFusion. Newest first.

Show 7 older incidents

Jul 7HighAdobe ColdFusion: Adobe ColdFusion Path Traversal VulnerabilityPatched
Adobe ColdFusion Patched
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. Added to CISA KEV on 2026-07-07.
Open incident →CVE-2026-48282

Feb 24CriticalAdobe ColdFusion: ColdFusion Deserialization VulnerabilityPatched
Adobe ColdFusion Patched
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution. Added to CISA KEV on 2025-02-24.
Open incident →CVE-2017-3066

Mar 18HighAdobe ColdFusion Improper Access ControlPatched
Adobe ColdFusion Patched
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. Added to the CISA KEV catalog on 2024-12-16.
Open incident →CVE-2024-20767

Jan 8CriticalAdobe ColdFusion: 2 actively exploited vulnerabilitiesPatched
Adobe ColdFusion Patched
CVE-2023-29300: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CVE-2023-38203: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. Added to the CISA KEV catalog on 2024-01-08. CISA lists known use in ransomware campaigns. CVE-2023-29300, CVE-2023-38203 were assigned before 2024; the KEV listing came in 2024.
Open incident →CVE-2023-29300 · CVE-2023-38203

Aug 21CriticalAdobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26359)Patched
Adobe ColdFusion Patched
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. Added to CISA KEV on 2023-08-21.
Open incident →CVE-2023-26359

Jul 20HighAdobe ColdFusion: 2 exploited vulnerabilities (CVE-2023-29298, CVE-2023-38205)Patched
Adobe ColdFusion Patched
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. Added to CISA KEV on 2023-07-20.
Open incident →CVE-2023-29298 · CVE-2023-38205

Mar 15HighAdobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360)Patched
Adobe ColdFusion Patched
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. Added to CISA KEV on 2023-03-15.
Open incident →CVE-2023-26360

1 ColdFusion incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore