Adobe ColdFusion vulnerabilities

286 CVEs affecting Adobe ColdFusion, 17 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-106624, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-29300: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability, published 2023-07-12. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-01-08. EPSS: 100% chance of exploitation in the next 30 days. Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in…
CVE-2018-15961: Adobe ColdFusion Unrestricted File Upload Vulnerability, published 2018-09-25. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to…
CVE-2023-29298: Adobe ColdFusion Improper Access Control Vulnerability, published 2023-07-12. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-07-20. EPSS: 99.8% chance of exploitation in the next 30 days. Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security…
CVE-2023-38205: Adobe ColdFusion Improper Access Control Vulnerability, published 2023-09-14. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-07-20. EPSS: 99.8% chance of exploitation in the next 30 days. Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass.…
CVE-2010-2861: Adobe ColdFusion Directory Traversal Vulnerability, published 2010-08-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 99.7% chance of exploitation in the next 30 days. Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1)…
CVE-2024-20767: Adobe ColdFusion Improper Access Control Vulnerability, published 2024-03-18. High severity, CVSS 7.4. Actively exploited: in CISA KEV since 2024-12-16. EPSS: 98.5% chance of exploitation in the next 30 days. ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability…
CVE-2023-26360: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability, published 2023-03-23. High severity, CVSS 8.6. Actively exploited: in CISA KEV since 2023-03-15. EPSS: 97.3% chance of exploitation in the next 30 days. Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the…
CVE-2023-38203: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability, published 2023-07-20. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-01-08. EPSS: 97.1% chance of exploitation in the next 30 days. Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code…
CVE-2013-0625: Adobe ColdFusion Authentication Bypass Vulnerability, published 2013-01-09. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-07. EPSS: 93.8% chance of exploitation in the next 30 days. Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited…
CVE-2013-0632: Adobe ColdFusion Authentication Bypass Vulnerability, published 2013-01-17. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 93.6% chance of exploitation in the next 30 days. administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the…

Latest

CVE-2026-106624, published 2026-10-13. Critical severity, CVSS 10.0. EPSS: 1% chance of exploitation in the next 30 days. ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker…
CVE-2026-106623, published 2026-10-13. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information.…
CVE-2026-106622, published 2026-10-13. Critical severity, CVSS 10.0. EPSS: 0.7% chance of exploitation in the next 30 days. ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106621, published 2026-10-13. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker…
CVE-2026-106620, published 2026-10-13. Critical severity, CVSS 9.6. EPSS: 0.3% chance of exploitation in the next 30 days. ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security…
CVE-2026-106619, published 2026-10-13. Critical severity, CVSS 9.0. EPSS: 0.6% chance of exploitation in the next 30 days. ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to…
CVE-2026-106618, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this…
CVE-2026-106617, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.1% chance of exploitation in the next 30 days. ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this…
CVE-2026-106616, published 2026-10-13. High severity, CVSS 8.6. EPSS: 0.5% chance of exploitation in the next 30 days. ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to…
CVE-2026-106615, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.1% chance of exploitation in the next 30 days. ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this…