CVE-2023-26359: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CVE-2023-26359 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2023-08-21

Adobe ColdFusion is vulnerable to deserialization of untrusted data. An unauthenticated attacker can exploit this to execute arbitrary code in the context of the current user without requiring user interaction.

Technologies: Adobe ColdFusion. Vendors: Adobe.

Quick answers

Is CVE-2023-26359 exploited in the wild?
Yes. CVE-2023-26359 is known to be exploited in the wild, first recorded on 21 August 2023. Treat it as urgent.
How severe is CVE-2023-26359?
Critical severity, with a CVSS score of 9.8, published 21 August 2023.
Which products and versions are affected?
Adobe ColdFusion 2018 Update 15 and earlier; Adobe ColdFusion 2021 Update 5 and earlier.
Is there a fix for CVE-2023-26359?
A patch was published on 2023-11-21: Patch reference updated in advisory Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-26359 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2023-26359?
Check whether you run Adobe ColdFusion. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Adobe ColdFusion 2018 Update 15 and earlier
  • Adobe ColdFusion 2021 Update 5 and earlier

Timeline

  • 2023-03-23: disclosed: NVD Published Date
  • 2023-08-21: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2023-11-21: patched: Patch reference updated in advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.