{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:38:01.102Z",
  "tag": {
    "id": "coldfusion",
    "label": "ColdFusion",
    "isStack": false,
    "url": "https://pwn.watch/t/coldfusion",
    "feed": "https://pwn.watch/t/coldfusion/feed.xml"
  },
  "counts": {
    "incidents": 7,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 7
  },
  "incidents": [
    {
      "slug": "adobe-coldfusion-cve-2026-48282",
      "title": "Adobe ColdFusion: Adobe ColdFusion Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2026-48282",
      "json": "https://pwn.watch/i/adobe-coldfusion-cve-2026-48282.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adobe ColdFusion",
      "tags": [
        "adobe",
        "coldfusion",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-48282"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-07",
      "closedAt": "2026-07-07",
      "updatedAt": "2026-07-07",
      "summary": "Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. Added to CISA KEV on 2026-07-07.",
      "xPost": null
    },
    {
      "slug": "adobe-coldfusion-cve-2017-3066",
      "title": "Adobe ColdFusion: ColdFusion Deserialization Vulnerability",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2017-3066",
      "json": "https://pwn.watch/i/adobe-coldfusion-cve-2017-3066.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Adobe ColdFusion",
      "tags": [
        "adobe",
        "coldfusion",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2017-3066"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-02-24",
      "closedAt": "2025-02-24",
      "updatedAt": "2025-02-24",
      "summary": "Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution. Added to CISA KEV on 2025-02-24.",
      "xPost": null
    },
    {
      "slug": "adobe-coldfusion-cve-2024-20767",
      "title": "Adobe ColdFusion Improper Access Control",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2024-20767",
      "json": "https://pwn.watch/i/adobe-coldfusion-cve-2024-20767.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adobe ColdFusion",
      "tags": [
        "adobe",
        "coldfusion",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-20767"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-03-18",
      "closedAt": "2024-12-16",
      "updatedAt": "2024-12-16",
      "summary": "Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. Added to the CISA KEV catalog on 2024-12-16.",
      "xPost": null
    },
    {
      "slug": "adobe-coldfusion-cve-2023-29300-38203",
      "title": "Adobe ColdFusion: 2 actively exploited vulnerabilities",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203",
      "json": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Adobe ColdFusion",
      "tags": [
        "adobe",
        "coldfusion",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2023-29300",
        "CVE-2023-38203"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-08",
      "closedAt": "2024-01-08",
      "updatedAt": "2024-01-08",
      "summary": "CVE-2023-29300: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CVE-2023-38203: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. Added to the CISA KEV catalog on 2024-01-08. CISA lists known use in ransomware campaigns. CVE-2023-29300, CVE-2023-38203 were assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "adobe-coldfusion-cve-2023-26359",
      "title": "Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26359)",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26359",
      "json": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26359.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Adobe ColdFusion",
      "tags": [
        "adobe",
        "coldfusion",
        "cisa-kev",
        "deserialization"
      ],
      "cveIds": [
        "CVE-2023-26359"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-08-21",
      "closedAt": "2023-08-21",
      "updatedAt": "2023-08-21",
      "summary": "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. Added to CISA KEV on 2023-08-21.",
      "xPost": null
    },
    {
      "slug": "adobe-coldfusion-cve-2023-29298-38205",
      "title": "Adobe ColdFusion: 2 exploited vulnerabilities (CVE-2023-29298, CVE-2023-38205)",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29298-38205",
      "json": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29298-38205.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adobe ColdFusion",
      "tags": [
        "adobe",
        "coldfusion",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-29298",
        "CVE-2023-38205"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-07-20",
      "closedAt": "2023-07-20",
      "updatedAt": "2023-07-20",
      "summary": "Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. Added to CISA KEV on 2023-07-20.",
      "xPost": null
    },
    {
      "slug": "adobe-coldfusion-cve-2023-26360",
      "title": "Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360)",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26360",
      "json": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26360.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adobe ColdFusion",
      "tags": [
        "adobe",
        "coldfusion",
        "cisa-kev",
        "rce",
        "deserialization"
      ],
      "cveIds": [
        "CVE-2023-26360"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-03-15",
      "closedAt": "2023-03-15",
      "updatedAt": "2023-03-15",
      "summary": "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. Added to CISA KEV on 2023-03-15.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "adobe-coldfusion-cve-2026-48282",
      "incidentTitle": "Adobe ColdFusion: Adobe ColdFusion Path Traversal Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-07",
      "title": "CISA added CVE-2026-48282 to the KEV catalog (due 2026-07-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2026-48282"
    },
    {
      "incident": "adobe-coldfusion-cve-2017-3066",
      "incidentTitle": "Adobe ColdFusion: ColdFusion Deserialization Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-02-24",
      "title": "CISA added CVE-2017-3066 to the KEV catalog (due 2025-03-17).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2017-3066"
    },
    {
      "incident": "adobe-coldfusion-cve-2024-20767",
      "incidentTitle": "Adobe ColdFusion Improper Access Control",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-16",
      "title": "CISA added CVE-2024-20767 to the KEV catalog (federal deadline 2025-01-06)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2024-20767"
    },
    {
      "incident": "adobe-coldfusion-cve-2024-20767",
      "incidentTitle": "Adobe ColdFusion Improper Access Control",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-18",
      "title": "CVE-2024-20767 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20767",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2024-20767"
    },
    {
      "incident": "adobe-coldfusion-cve-2023-29300-38203",
      "incidentTitle": "Adobe ColdFusion: 2 actively exploited vulnerabilities",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-08",
      "title": "CISA added CVE-2023-29300 to the KEV catalog (federal deadline 2024-01-29)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203"
    },
    {
      "incident": "adobe-coldfusion-cve-2023-29300-38203",
      "incidentTitle": "Adobe ColdFusion: 2 actively exploited vulnerabilities",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-08",
      "title": "CISA added CVE-2023-38203 to the KEV catalog (federal deadline 2024-01-29)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203"
    },
    {
      "incident": "adobe-coldfusion-cve-2023-26359",
      "incidentTitle": "Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26359)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-21",
      "title": "CISA added CVE-2023-26359 to the KEV catalog (due 2023-09-11).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26359"
    },
    {
      "incident": "adobe-coldfusion-cve-2023-29298-38205",
      "incidentTitle": "Adobe ColdFusion: 2 exploited vulnerabilities (CVE-2023-29298, CVE-2023-38205)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-20",
      "title": "CISA added CVE-2023-29298 to the KEV catalog (due 2023-08-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29298-38205"
    },
    {
      "incident": "adobe-coldfusion-cve-2023-29298-38205",
      "incidentTitle": "Adobe ColdFusion: 2 exploited vulnerabilities (CVE-2023-29298, CVE-2023-38205)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-20",
      "title": "CISA added CVE-2023-38205 to the KEV catalog (due 2023-08-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29298-38205"
    },
    {
      "incident": "adobe-coldfusion-cve-2023-26360",
      "incidentTitle": "Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-15",
      "title": "CISA added CVE-2023-26360 to the KEV catalog (due 2023-04-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26360"
    }
  ]
}