Wednesday, April 30, 2025
HomeAdobeCISA Urgent Warning: Adobe ColdFusion Bug Exploited As A Zero-day in the...

CISA Urgent Warning: Adobe ColdFusion Bug Exploited As A Zero-day in the Wild

Published on

SIEM as a Service

Follow Us on Google News

CISA has updated its list of security flaws that have been actively exploited, including a critical vulnerability affecting Adobe ColdFusion versions 2021 and 2018.

The vulnerability is tracked as (CVE-2023-26360), Adobe ColdFusion Improper Access Control flaw. These flaws provide serious threats to the federal enterprise and are frequently used as attack vectors by malicious actors.

“Adobe is aware that CVE-2023-26360 has been exploited in the wild in very limited attacks targeting Adobe ColdFusion,” the company said.

- Advertisement - Google News

The report says using low-complexity techniques that don’t necessitate user interaction, the flaw can be remotely exploited by unauthenticated attackers.

As a zero-day exploit, the application server vulnerability was patched by Adobe in ColdFusion 2018 Update 16 and ColdFusion 2021 Update 6.

Although installations of ColdFusion 2016 and ColdFusion 11 are likewise vulnerable, Adobe no longer offers security updates for those versions.

Administrators are urged to implement the security configuration settings described in the lockdown instructions for ColdFusion 2018 and ColdFusion 2021 as soon as possible (within 72 hours, if practicable), along with the security upgrades.

CISA’s Recommendations

All U.S. Federal Civilian Executive Branch (FCEB) entities have until April 5 to protect their systems from potential attacks employing CVE-2023-26360 flaws, according to CISA.

All organizations are strongly advised to patch their systems to avoid exploitation attempts that might target their networks, even though the binding operational directive (BOD 22-01) driving CISA’s mandate only applies to federal agencies.

“CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice,” CISA reports.

In a comment to Adobe’s blog post, Charlie Arehart—one of the two security researchers credited with finding and disclosing the CVE-2023-26360 bug, warned ColdFusion administrators of the real significance of the security patches and the urgency with which they must be patched.

“This security fix is far more important than the wording of this blog post suggests and even that the update technotes would suggest,” Arehart warned.

“To be clear, I HAVE personally seen both the ‘arbitrary code execution‘ and ‘arbitrary file system read’ vulnerabilities having been perpetrated on multiple servers and it IS grave.”

Network Security Checklist – Download Free E-Book

Recent CISA Warnings

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...

Researchers Reveal Threat Actor TTP Patterns and DNS Abuse in Investment Scams

Cybersecurity researchers have uncovered the intricate tactics, techniques, and procedures (TTPs) employed by threat...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...