CVE-2023-26360: Adobe ColdFusion Improper Access Control

CVE-2023-26360 is an Improper Access Control vulnerability in Adobe ColdFusion. It affects versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier). The vulnerability allows arbitrary code execution in the context of the current user without requiring user interaction, significantly increasing the risk of compromise for systems running ColdFusion.

The CVSS score is 8.6 with declared severity HIGH: a critical vulnerability for production environments. The CVE was officially published on March 23, 2023. As of November 2026, public GitHub repositories have been flagged as declaring to contain related exploits: an indicator of renewed interest from the research community. However, signals on social networks (X) remain absent, suggesting a more contained disclosure compared to other vulnerabilities of equal severity.

Defenders must urgently verify which ColdFusion version is running in their environments. If versions 2018 Update 15 or 2021 Update 5 (or earlier) are found, patching becomes a maximum priority. Beyond updating, it is recommended to strengthen access log monitoring on ColdFusion systems, particularly looking for anomalous requests or unauthorized access attempts. The fact that no user interaction is required makes this vulnerability especially dangerous in exposed networks.