CVE-2023-26360: Adobe ColdFusion unauthenticated file read and code execution, actively exploited
The short version: Adobe ColdFusion has an improper access-control flaw (CVE-2023-26360) that lets an unauthenticated attacker read sensitive files and execute code in the context of the ColdFusion service — no login, no user interaction. It's in CISA's KEV catalog and was used for initial access against government servers. If you run an affected build, patch and check for prior access. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~97.34% · 99.89th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-04-05 |
| Known exploited? | Yes — used for initial access to government servers (CISA AA23-339A) |
| Vulnerability type | CWE-284 improper access control → unauthenticated arbitrary file read / code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | ColdFusion 2018 Update 15 and earlier; ColdFusion 2021 Update 5 and earlier |
| Fixed in | ColdFusion 2018 Update 16 · ColdFusion 2021 Update 6 (APSB23-25) |
What you need to know
CVE-2023-26360 is an improper access-control flaw in Adobe ColdFusion. By sending a crafted request to an exposed ColdFusion server, an unauthenticated attacker can read files they should never reach — including configuration and credential material — and, depending on the environment, execute code in the context of the ColdFusion service. There's no login step and no user interaction required.
Why this one deserves the top of the queue:
- It's pre-authentication and internet-reachable. ColdFusion often fronts business web applications, so the vulnerable component is exactly the part meant to be exposed.
- It's already been used in real intrusions. CISA documented threat actors exploiting it to gain initial access to federal government servers, so the theoretical is operational.
- What leaks is leverage. File read on the server hands an attacker the material to deepen access, not just a one-off disclosure.
How serious we see it
High — the 9.8 holds up here.
Unauthenticated, network-reachable access to files and code on an application server, confirmed exploited in the wild and listed in KEV, is textbook top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects specific ColdFusion update levels, the fixes are published, and you can determine quickly whether you run an affected build. The catch is the usual one for an actively exploited flaw — being patched and being clean are separate questions.
Recommendations
Straight from Adobe's bulletin (APSB23-25) and CISA:
- Patch now. Upgrade to ColdFusion 2018 Update 16 or 2021 Update 6 (or later).
- Apply Adobe's hardening. Review Adobe's serial-filter guidance to reduce insecure-deserialization exposure.
- Hunt for prior use. Review web and application logs for anomalous requests and file access around the vulnerable endpoints.
- If you find indicators, respond. Rotate credentials and secrets reachable from the server, and investigate for lateral movement.
- Confirm your exposure first. Verify whether you run an internet-facing ColdFusion server and which update level.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing ColdFusion servers, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV and because the real-world impact backs it up.
That continuous, attacker's-eye view is the point: when a ColdFusion flaw is being used for initial access in the wild, the exposed server is already mapped, so you can go straight to patch-and-verify.