CVE-2023-26360
Adobe ColdFusion Improper Access Control Arbitrary code execution
KEVCRITICAL 9.8EPSS 97.3%
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
- Affected
- Adobe · ColdFusion
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 ADOBE
- 8.6 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - EPSS
- 97.34% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2023-03-15
- Nuclei
- high · CWE-284
- Published
- 2023-03-23
- Updated
- 2025-10-21
Proof-of-concept exploits (6)
- http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-…
- jakabakos/CVE-2023-26360-adobe-coldfusion-rce-exploit5★ · 2024-05-14
- yosef0x01/CVE-2023-263604★ · 2024-06-22
- H3rm1tR3b0rn/CVE-2023-26360-RCE1★ · 2025-10-28
- RyanRodrigues880/CVE-2023-263600★ · 2025-11-28
- joaoaugustom/Adobe_ColdFusion_RCE_Unauthenticated1★ · 2026-05-24
Nuclei templates (1)
Metasploit modules (2)
- rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/adobe_coldfusion_rce_…
- rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/adobe_coldfusion_filerea…
Vulhub environments (1)
Exploit collections (1)
- CVE-2023-26360.yamlzan8in/afrog
Security advisories
- https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360