Thursday, March 28, 2024

CISA Urgent Warning: Adobe ColdFusion Bug Exploited As A Zero-day in the Wild

CISA has updated its list of security flaws that have been actively exploited, including a critical vulnerability affecting Adobe ColdFusion versions 2021 and 2018.

The vulnerability is tracked as (CVE-2023-26360), Adobe ColdFusion Improper Access Control flaw. These flaws provide serious threats to the federal enterprise and are frequently used as attack vectors by malicious actors.

“Adobe is aware that CVE-2023-26360 has been exploited in the wild in very limited attacks targeting Adobe ColdFusion,” the company said.

The report says using low-complexity techniques that don’t necessitate user interaction, the flaw can be remotely exploited by unauthenticated attackers.

As a zero-day exploit, the application server vulnerability was patched by Adobe in ColdFusion 2018 Update 16 and ColdFusion 2021 Update 6.

Although installations of ColdFusion 2016 and ColdFusion 11 are likewise vulnerable, Adobe no longer offers security updates for those versions.

Administrators are urged to implement the security configuration settings described in the lockdown instructions for ColdFusion 2018 and ColdFusion 2021 as soon as possible (within 72 hours, if practicable), along with the security upgrades.

CISA’s Recommendations

All U.S. Federal Civilian Executive Branch (FCEB) entities have until April 5 to protect their systems from potential attacks employing CVE-2023-26360 flaws, according to CISA.

All organizations are strongly advised to patch their systems to avoid exploitation attempts that might target their networks, even though the binding operational directive (BOD 22-01) driving CISA’s mandate only applies to federal agencies.

“CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice,” CISA reports.

In a comment to Adobe’s blog post, Charlie Arehart—one of the two security researchers credited with finding and disclosing the CVE-2023-26360 bug, warned ColdFusion administrators of the real significance of the security patches and the urgency with which they must be patched.

“This security fix is far more important than the wording of this blog post suggests and even that the update technotes would suggest,” Arehart warned.

“To be clear, I HAVE personally seen both the ‘arbitrary code execution‘ and ‘arbitrary file system read’ vulnerabilities having been perpetrated on multiple servers and it IS grave.”

Network Security Checklist – Download Free E-Book

Recent CISA Warnings

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles