Product of Adobe
ColdFusion
As of , 16 Adobe ColdFusion vulnerabilities are on CISA's list of exploited vulnerabilities, 3 of them used in ransomware campaigns; 1 was added in 2026. Patch first: CVE-2026-48282.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-48282Path Traversal | Adobe ColdFusion | Patch nowForensic triage required by CISA | 0.42 | ||
| 2 | CVE-2010-2861Directory Traversal | Adobe ColdFusion | Patch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry | 0.99 | ||
| 3 | CVE-2013-0632Authentication Bypass | Adobe ColdFusion | Patch this weekMetasploit module; EPSS 0.94; verified Exploit-DB entry | 0.94 | ||
| 4 | CVE-2024-20767Improper Access Control | Adobe ColdFusion | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 5 | CVE-2023-26360Deserialization of Untrusted Data | Adobe ColdFusion | Patch this weekMetasploit module; EPSS 0.97 | 0.97 | ||
| 6 | CVE-2018-15961Unrestricted File Upload | Adobe ColdFusion | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 7 | CVE-2013-0625Authentication Bypass | Adobe ColdFusion | Patch this weekEPSS 0.94; verified Exploit-DB entry | 0.94 | ||
| 8 | CVE-2013-0629Directory Traversal | Adobe ColdFusion | Patch this weekEPSS 0.66; verified Exploit-DB entry | 0.66 | ||
| 9 | CVE-2017-3066Deserialization | Adobe ColdFusion | Patch this weekEPSS 0.91 | 0.91 | ||
| 10 | CVE-2023-29300Deserialization of Untrusted Data | Adobe ColdFusion | Patch this weekRansomware use; EPSS 0.99 | 0.99 | ||
| 11 | CVE-2023-38203Deserialization of Untrusted Data | Adobe ColdFusion | Patch this weekRansomware use; EPSS 0.97 | 0.97 | ||
| 12 | CVE-2023-29298Improper Access Control | Adobe ColdFusion | Patch this weekEPSS 0.99 | 0.99 | ||
| 13 | CVE-2023-38205Improper Access Control | Adobe ColdFusion | Patch this weekEPSS 0.99 | 0.99 | ||
| 14 | CVE-2013-0631Information Disclosure | Adobe ColdFusion | Patch this weekEPSS 0.66 | 0.66 | ||
| 15 | CVE-2018-4939Deserialization of Untrusted Data | Adobe ColdFusion | Patch this weekEPSS 0.62 | 0.62 | ||
| 16 | CVE-2023-26359Deserialization of Untrusted Data | Adobe ColdFusion | Patch soon | 0.17 |
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2021 | 2 |
| 2022 | 5 |
| 2023 | 4 |
| 2024 | 3 |
| 2025 | 1 |
| 2026 | 1 |