CVE-2023-26360

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-26360
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html Patch Vendor Advisory
http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html Patch Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*
History

23 Oct 2025, 11:12

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360 - Third Party Advisory, US Government Resource

22 Oct 2025, 00:18

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360 -

21 Oct 2025, 20:19

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:19

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360 -

21 Nov 2024, 07:51

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry
References () https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html - Patch, Vendor Advisory () https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html - Patch, Vendor Advisory

28 Jun 2024, 13:41

Type Values Removed Values Added
CWE NVD-CWE-Other
References () http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html - () http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry

01 May 2023, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 8.6
References
  • (MISC) http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html -

28 Mar 2023, 13:01

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-23 20:15

Updated : 2025-10-23 11:12

NVD link : CVE-2023-26360

Mitre link : CVE-2023-26360

CVE.ORG link : CVE-2023-26360

JSON object : View

Products Affected

adobe

  • coldfusion
CWE
CWE-284

Improper Access Control

NVD-CWE-Other