CVE-2024-20767: Adobe ColdFusion arbitrary file read via exposed admin panel, actively exploited
The short version: Adobe ColdFusion has an improper access-control flaw (CVE-2024-20767) that lets an unauthenticated attacker read arbitrary files from the server when the ColdFusion administration panel is reachable from the internet. There's a public proof-of-concept and it's in CISA's KEV catalog. Patch, and get the admin panel off the public internet. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — actively exploited, but bounded by the admin-panel precondition |
| CVSS v3.1 (NVD) | 7.4 — High · AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| EPSS | ~98.51% · 99.91th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-01-06 |
| Known exploited? | Yes — public proof-of-concept; CISA-listed as exploited |
| Vulnerability type | CWE-284 improper access control → unauthenticated arbitrary file system read |
| Requires authenticated session? | No — pre-authentication, but requires the admin panel be internet-exposed |
| Affected | ColdFusion 2023.6 and earlier; ColdFusion 2021.12 and earlier |
| Fixed in | ColdFusion 2023 Update 7 · ColdFusion 2021 Update 13 (APSB24-14) |
What you need to know
CVE-2024-20767 is an improper access-control flaw in Adobe ColdFusion. When the ColdFusion administration panel is exposed to the internet, an unauthenticated attacker can leverage the flaw to read arbitrary files from the underlying host — configuration, secrets, and other material they should never be able to reach. No login and no user interaction are required.
The practical shape of the risk:
- The precondition is the admin panel. Exploitation depends on the ColdFusion admin console being reachable from the internet — which it shouldn't be. Where it is, the door is open.
- It's already operational. A public proof-of-concept exists and CISA lists it as exploited, so this is not theoretical.
- File read is leverage. Reading server-side files hands an attacker credentials and configuration to deepen access.
How serious we see it
High — actively exploited, with the severity bounded by exposure.
The NVD base score is 7.4 because the impact is file disclosure rather than direct code execution, and because exploitation hinges on the admin panel being reachable. We still rate it High: it's in KEV, it has a public exploit, and what it discloses can seed a deeper compromise. The reassuring part is that you control both levers — patch the flaw, and keep the administration console off the public internet — and you can verify your exposure quickly.
Recommendations
Straight from Adobe's bulletin (APSB24-14) and CISA:
- Patch now. Upgrade to ColdFusion 2023 Update 7 or 2021 Update 13 (or later).
- Get the admin panel off the internet. Restrict the ColdFusion administration console to trusted networks or a VPN — this removes the precondition for exploitation.
- Hunt for prior use. Review logs for anomalous requests to administrative endpoints and unexpected file access.
- If you find indicators, respond. Rotate credentials and secrets reachable from the server.
- Confirm your exposure first. Verify whether you run an affected ColdFusion build with the admin panel reachable from the internet.
How BreachRisk sees it
BreachRisk answers the first question — is there an exposed, affected ColdFusion server, admin panel and all? — from the outside in. Starting from little more than your domain, it discovers internet-facing ColdFusion services, fingerprints the product and version, and flags exposure tied to KEV-listed vulnerabilities like this one, pushed to the top of your results because it's in KEV.
That continuous, attacker's-eye view means an exposed administration console doesn't wait for someone to notice it — it surfaces as a ranked finding while you can still act.