CVE-2013-0632: Adobe ColdFusion Authentication Bypass Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 93.6% chance of exploitation in the next 30 days.

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

Affected products

• Adobe ColdFusion: version 9.0 only; version 9.0.1 only; version 9.0.2 only; version 10.0 only

Published 2013-01-17. Last modified 2026-06-16.