CVE-2023-26360

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

97.34% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2023-03-15

Nuclei

high · CWE-284

Published

2023-03-23

Updated

2025-10-21

Proof-of-concept exploits (6)

• http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-…
• jakabakos/CVE-2023-26360-adobe-coldfusion-rce-exploit5★ · 2024-05-14
• yosef0x01/CVE-2023-263605★ · 2024-06-22
• H3rm1tR3b0rn/CVE-2023-26360-RCE
• RyanRodrigues880/CVE-2023-26360
• joaoaugustom/Adobe_ColdFusion_RCE_Unauthenticated

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26360.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/adobe_coldfusion_rce_…

Vulhub environments (1)

• vulhub/vulhub/tree/master/coldfusion/CVE-2023-26360

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2023/CVE-2023-26360.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2017-9096
• CVE-2022-22965
• CVE-2022-40127
• CVE-2023-22884
• CVE-2023-22952
• CVE-2023-26359