pwn.watch: ColdFusion incident updates

[high] Adobe ColdFusion: Adobe ColdFusion Path Traversal Vulnerability

Tue, 07 Jul 2026 00:00:00 GMT

Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. Added to CISA KEV on 2026-07-07.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-07-07: CISA added CVE-2026-48282 to the KEV catalog (due 2026-07-10).

CVEs: CVE-2026-48282

[critical] Adobe ColdFusion: ColdFusion Deserialization Vulnerability

Mon, 24 Feb 2025 00:00:00 GMT

Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution. Added to CISA KEV on 2025-02-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-02-24: CISA added CVE-2017-3066 to the KEV catalog (due 2025-03-17).

CVEs: CVE-2017-3066

[high] Adobe ColdFusion Improper Access Control

Mon, 16 Dec 2024 00:00:00 GMT

Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. Added to the CISA KEV catalog on 2024-12-16.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-12-16: CISA added CVE-2024-20767 to the KEV catalog (federal deadline 2025-01-06) (source)
2024-03-18: CVE-2024-20767 published (source)

CVEs: CVE-2024-20767

[critical] Adobe ColdFusion: 2 actively exploited vulnerabilities

Mon, 08 Jan 2024 00:00:00 GMT

CVE-2023-29300: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CVE-2023-38203: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. Added to the CISA KEV catalog on 2024-01-08. CISA lists known use in ransomware campaigns. CVE-2023-29300, CVE-2023-38203 were assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-08: CISA added CVE-2023-29300 to the KEV catalog (federal deadline 2024-01-29) (source)
2024-01-08: CISA added CVE-2023-38203 to the KEV catalog (federal deadline 2024-01-29) (source)

CVEs: CVE-2023-29300, CVE-2023-38203

[critical] Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26359)

Mon, 21 Aug 2023 00:00:00 GMT

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. Added to CISA KEV on 2023-08-21.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-08-21: CISA added CVE-2023-26359 to the KEV catalog (due 2023-09-11).

CVEs: CVE-2023-26359

[high] Adobe ColdFusion: 2 exploited vulnerabilities (CVE-2023-29298, CVE-2023-38205)

Thu, 20 Jul 2023 00:00:00 GMT

Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. Added to CISA KEV on 2023-07-20.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-07-20: CISA added CVE-2023-29298 to the KEV catalog (due 2023-08-10).
2023-07-20: CISA added CVE-2023-38205 to the KEV catalog (due 2023-08-10).

CVEs: CVE-2023-29298, CVE-2023-38205

[high] Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360)

Wed, 15 Mar 2023 00:00:00 GMT

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. Added to CISA KEV on 2023-03-15.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-03-15: CISA added CVE-2023-26360 to the KEV catalog (due 2023-04-05).

CVEs: CVE-2023-26360