CVE-2023-38205: Adobe ColdFusion access-control bypass (the patch-bypass fix), actively exploited
The short version: CVE-2023-38205 is an access-control bypass in Adobe ColdFusion — specifically the flaw that defeated Adobe's first patch for the earlier CVE-2023-29298 and let an unauthenticated attacker keep reaching administrator CFM and CFC endpoints. It was exploited in the wild and it's in CISA's KEV catalog. If you patched ColdFusion early in July 2023, this is the one you need to be past. Steady hands — confirm you're on the complete fix.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | ~99.73% · 99.95th percentile (2026-07-17) |
| In CISA KEV? | Yes — added 2023-07-20, remediation was due 2023-08-10 |
| Known exploited? | Yes — exploited in the wild |
| Vulnerability type | CWE-284 improper access control → security-feature bypass reaching admin endpoints |
| Requires authenticated session? | No — pre-authentication |
| Affected | Adobe ColdFusion 2018 Update 18 and earlier · 2021 Update 8 and earlier · 2023 Update 2 and earlier |
| Fixed in | The updates published in APSB23-47 — ColdFusion 2023 Update 3 (and the corresponding 2021 / 2018 updates) |
What you need to know
CVE-2023-38205 is an improper access-control flaw — the same class of bug as CVE-2023-29298, and directly related to it. When Adobe shipped the first fix for CVE-2023-29298, researchers at Rapid7 found the patch could be bypassed: a trivially modified request still reached the administrator endpoints. That bypass is CVE-2023-38205, and Adobe addressed it in an out-of-band update (APSB23-47) on July 19, 2023.
The mechanics come down to how ColdFusion resolved paths to CFM and CFC endpoints. A crafted URL path could still reach a protected endpoint even though it wasn't a legitimate path — so the access control that was supposed to stop unauthenticated requests didn't.
- It's pre-authentication and reachable. The administrator path on an internet-facing app server is exactly where attackers probe.
- It was live in the wild. Adobe confirmed limited attacks in the wild; that's why it's KEV-listed.
- It's a patch-bypass. Organizations that applied the first July 2023 update may have believed they were covered when they weren't. Being "patched in July 2023" isn't the same as being on the complete fix.
How serious we see it
High — above the base 7.5, for the same reason as its predecessor.
CVSS scores this as confidentiality-only, and mechanically that's fair. But an unauthenticated bypass that reaches administrator endpoints on an internet-facing application server, exploited in the wild and KEV-listed, does more damage than a 7.5 implies — access to those endpoints is a stepping stone toward deeper compromise. We keep it below Critical because, by itself, it's a bypass rather than direct code execution. The reassuring part is that it's bounded and fixable: specific ColdFusion builds, a published fix, and quick to confirm — the one wrinkle being that you must confirm you're on the complete update, not the bypassed one.
Recommendations
Straight from Adobe's bulletin (APSB23-47) and CISA:
- Confirm you're on the complete fix. Apply the APSB23-47 updates (ColdFusion 2023 Update 3 and the corresponding 2021/2018 updates) or later — this is the fix that survives the bypass.
- Update the JDK/JRE too. Per Adobe, the ColdFusion update alone does not fully secure the server without the corresponding JDK/JRE update.
- Enforce IP restrictions. Adobe notes that enforcing ColdFusion's allowed-IP restrictions on the server also addresses this vulnerability — do it regardless.
- Hunt. Check the web root — especially
CFIDE— for unexpected.cfm/.cfcfiles or web shells, and review logs for anomalous requests to admin endpoints. - If compromised, respond. Remove web shells, rebuild where warranted, and rotate credentials, keys, and secrets on the host.
- Confirm your exposure first. Verify whether you run an affected ColdFusion build, and which update level.
How BreachRisk sees it
BreachRisk works from the outside in. Starting from little more than your domain, it discovers internet-facing ColdFusion servers, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV. We detect and flag the exposed, affected server; we don't exploit it.
For a patch-bypass like this, that continuous view is exactly what catches the gap: a server someone believed they'd fixed in July 2023, still exposed because it never reached the complete update, shows up ranked by real-world risk rather than by an assumption that it was already handled.