CVE-2023-29298: Adobe ColdFusion access-control bypass, actively exploited
The short version: CVE-2023-29298 is an access-control bypass in Adobe ColdFusion that lets an unauthenticated attacker reach the administrator CFM and CFC endpoints they shouldn't be able to. On its own it "only" bypasses access control — but in the real world it was chained with a deserialization flaw to achieve remote code execution and drop web shells, and it's in CISA's KEV catalog. Adobe's first patch was incomplete, so the version you're on matters. Steady hands — patch to the complete fix.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | ~99.76% · 99.95th percentile (2026-07-17) |
| In CISA KEV? | Yes — added 2023-07-20, remediation was due 2023-08-10 |
| Known exploited? | Yes — exploited in the wild, chained to reach remote code execution |
| Vulnerability type | CWE-284 improper access control → security-feature bypass reaching admin endpoints |
| Requires authenticated session? | No — pre-authentication |
| Affected | Adobe ColdFusion 2018 Update 16 and earlier · 2021 Update 6 and earlier · 2023.0.0.330468 and earlier |
| Fixed in | Initial fix in APSB23-40 (2018 Update 17 / 2021 Update 7 / 2023 GA build) was incomplete; the complete fix shipped as CVE-2023-38205 in APSB23-47 |
What you need to know
CVE-2023-29298 is an improper access-control flaw. ColdFusion is supposed to gate its administrator CFM and CFC endpoints; this bug lets an unauthenticated attacker slip past that gate and reach them anyway.
Access to those endpoints is dangerous less for what it is than for what it unlocks. In observed attacks, CVE-2023-29298 was the front half of a chain: bypass access control, then reach a second flaw (a deserialization vulnerability) to achieve remote code execution and drop a web shell — commonly landing in the CFIDE directory of the web root.
- It's pre-authentication and reachable. ColdFusion servers front web applications; the admin path is exactly where an attacker probes.
- It was live in the wild. This is why it's KEV-listed — real intrusions used it.
- The first patch didn't hold. Rapid7 found Adobe's initial fix could be trivially bypassed; the complete remediation is the follow-on CVE-2023-38205 fix in APSB23-47. If you patched early, confirm you're on the complete fix.
How serious we see it
High — above the 7.5 the base score suggests, and here's the honest gap.
By the letter of CVSS, this is "only" an information-boundary bypass — confidentiality impact, no direct integrity or availability. But an access-control bypass that reaches administrator endpoints on an internet-facing app server, that was chained to remote code execution in real attacks, and that sits in KEV, behaves like more than a 7.5. We rate it by what it enabled, not by which metric box it lands in. It stops short of our Critical band because, on its own, it doesn't hand an attacker code execution — it needs a partner flaw for that. The reassuring part: it affects specific ColdFusion builds, the complete fix is published, and exposure is quick to determine.
Recommendations
Straight from Adobe's bulletins (APSB23-40, APSB23-47) and CISA:
- Patch to the complete fix. Apply APSB23-47 (the CVE-2023-38205 update) — not just the initial APSB23-40 update, which was found to be bypassable.
- Update the JDK/JRE too. Per Adobe, a ColdFusion update without the corresponding JDK/JRE update does not fully secure the server.
- Hunt. Check the web root — especially
CFIDE— for unexpected.cfm/.cfcfiles or web shells, and review logs for anomalous requests to admin endpoints. - If compromised, respond. Remove web shells, rebuild where warranted, and rotate credentials, keys, and secrets on the host.
- Harden exposure. Enforce ColdFusion's IP-allowlist restrictions so the administrator endpoints aren't reachable from the whole internet.
- Confirm your exposure first. Verify whether you run an affected ColdFusion build, and which update level.
How BreachRisk sees it
BreachRisk works from the outside in. Starting from little more than your domain, it discovers internet-facing ColdFusion servers, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV. We detect and flag the exposed, affected server; we don't exploit it.
That's the value of a continuous attacker's-eye view for a flaw whose base score undersells it: you see the exposed server ranked by how it actually got used against organizations, not by a number that stops at "access-control bypass."