CISA Urgent Warning: Adobe ColdFusion Bug Exploited As A Zero-day in the Wild

CISA has updated its list of security flaws that have been actively exploited, including a critical vulnerability affecting Adobe ColdFusion versions 2021 and 2018.

The vulnerability is tracked as (CVE-2023-26360), Adobe ColdFusion Improper Access Control flaw. These flaws provide serious threats to the federal enterprise and are frequently used as attack vectors by malicious actors.

“Adobe is aware that CVE-2023-26360 has been exploited in the wild in very limited attacks targeting Adobe ColdFusion,” the company said.

The report says using low-complexity techniques that don’t necessitate user interaction, the flaw can be remotely exploited by unauthenticated attackers.

As a zero-day exploit, the application server vulnerability was patched by Adobe in ColdFusion 2018 Update 16 and ColdFusion 2021 Update 6.

Although installations of ColdFusion 2016 and ColdFusion 11 are likewise vulnerable, Adobe no longer offers security updates for those versions.

Administrators are urged to implement the security configuration settings described in the lockdown instructions for ColdFusion 2018 and ColdFusion 2021 as soon as possible (within 72 hours, if practicable), along with the security upgrades.

CISA’s Recommendations

All U.S. Federal Civilian Executive Branch (FCEB) entities have until April 5 to protect their systems from potential attacks employing CVE-2023-26360 flaws, according to CISA.

All organizations are strongly advised to patch their systems to avoid exploitation attempts that might target their networks, even though the binding operational directive (BOD 22-01) driving CISA’s mandate only applies to federal agencies.

“CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice,” CISA reports.

In a comment to Adobe’s blog post, Charlie Arehart—one of the two security researchers credited with finding and disclosing the CVE-2023-26360 bug, warned ColdFusion administrators of the real significance of the security patches and the urgency with which they must be patched.

“This security fix is far more important than the wording of this blog post suggests and even that the update technotes would suggest,” Arehart warned.

“To be clear, I HAVE personally seen both the ‘arbitrary code execution‘ and ‘arbitrary file system read’ vulnerabilities having been perpetrated on multiple servers and it IS grave.”

Network Security Checklist – Download Free E-Book

Recent CISA Warnings

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Hundreds of Fortune 500 Companies Have Unknowingly Employed North Korean IT Operatives

North Korean nationals have successfully infiltrated the employee ranks of major global corporations at a…

3 hours ago

Stealthy New NodeJS Backdoor Infects Users Through CAPTCHA Verifications

Security researchers have uncovered a sophisticated malware campaign utilizing fake CAPTCHA verification screens to deploy…

3 hours ago

State-Sponsored Hacktivism on the Rise, Transforming the Cyber Threat Landscape

Global cybersecurity landscape is undergoing a significant transformation, as state-sponsored hacktivism gains traction amid ongoing…

3 hours ago

NVIDIA Riva AI Speech Flaw Let Hackers Gain Unauthorized Access to Abuse GPU Resources & API keys

Researchers have uncovered significant security vulnerabilities in NVIDIA Riva, a breakthrough AI speech technology platform…

3 hours ago

Tsunami Malware Surge: Blending Miners and Credential Stealers in Active Attacks

Security researchers have recently discovered a sophisticated malware operation called the "Tsunami-Framework" that combines credential…

4 hours ago

The Double-Edged Sword of AI in Cybersecurity: Threats, Defenses & the Dark Web Insights Report 2025

Check Point Research's latest AI Security Report 2025 reveals a rapidly evolving cybersecurity landscape where…

4 hours ago