CVE-2023-26360

What it actually does

This vulnerability is a network-reachable improper access control flaw in Adobe ColdFusion 2018 Update 15 and earlier and ColdFusion 2021 Update 5 and earlier. An unauthenticated attacker can reach functionality that should be restricted and cause arbitrary code execution in the security context of the ColdFusion service account. Because exploitation requires no user interaction and no prior authentication, internet-facing ColdFusion instances are high-risk, especially where administrative, CFIDE, or script-related paths are exposed. The supplied package metadata also references joomla/joomla-cms with fixed commit 1dceaf228a25100963ee044e7c886244742ca0af; however, the CVE description and affected-version text identify Adobe ColdFusion, so asset owners should validate product mapping before relying on package-level remediation data.

Why it matters to the business

Successful exploitation can give an external attacker control over the application server process, allowing theft of application data, credentials, configuration secrets, source code, and potentially movement into connected systems. This vulnerability is listed in CISA Known Exploited Vulnerabilities, has a very high EPSS likelihood, and has been exploited in the wild for a prolonged period, so exposed systems should be treated as urgent remediation and threat-hunting priorities. Operational consequences may include web application compromise, unauthorized data access, malicious file placement, service disruption during incident response, and regulatory or contractual reporting obligations if sensitive data is exposed.

How an attack unfolds

An attacker first identifies an exposed Adobe ColdFusion server and fingerprints the version or reachable ColdFusion paths such as CFIDE, cf_scripts, administrative APIs, or script/plugin resources. The attacker then sends specially crafted unauthenticated HTTP requests to a vulnerable ColdFusion component or script endpoint that fails to enforce the intended access controls. If the server is vulnerable, ColdFusion processes the request as trusted functionality and the attacker gains the ability to execute code or place code that executes under the ColdFusion service account. After initial execution, common follow-on behavior includes uploading a CFML/JSP web shell, running operating-system commands through the Java/ColdFusion runtime, reading configuration files for database and service credentials, establishing persistence, and using the compromised server as a foothold for internal reconnaissance or lateral movement. Known exploitation activity has focused on internet-facing ColdFusion systems, and defenders should assume opportunistic scanning and automated exploitation attempts are common.

How to fix it

Upgrade Adobe ColdFusion immediately to a fixed or later update level: ColdFusion 2018 Update 16 or later, and ColdFusion 2021 Update 6 or later. Apply the latest cumulative Adobe ColdFusion security updates rather than stopping at the first fixed release. If package inventory maps this finding to joomla/joomla-cms, verify the mapping; where applicable, update to commit 1dceaf228a25100963ee044e7c886244742ca0af or later, but do not treat that as a substitute for ColdFusion patching when ColdFusion is present. Restrict external access to ColdFusion Administrator, CFIDE, adminapi, RDS, cf_scripts, and any unused example or diagnostic endpoints. Place administrative interfaces behind VPN or equivalent access controls, enforce strong authentication, disable RDS if not required, remove sample applications, and apply Adobe’s ColdFusion lockdown guidance. Run the ColdFusion service with least privilege, limit write permissions to web-accessible directories, block unnecessary outbound network access from application servers, and use WAF or reverse-proxy rules as temporary mitigation only until patching is complete.

How to confirm the fix worked

Confirm the installed ColdFusion major version and update level from the ColdFusion Administrator, update logs, or filesystem hotfix inventory, and verify that ColdFusion 2018 is on Update 16 or later or ColdFusion 2021 is on Update 6 or later. Where source/package tooling reports joomla/joomla-cms exposure, confirm whether commit 1dceaf228a25100963ee044e7c886244742ca0af or a later revision is present, and reconcile that finding with actual deployed products. Validate that CFIDE/adminapi, ColdFusion Administrator, cf_scripts, RDS, and example directories are not internet-accessible unless explicitly required and protected. Run authenticated vulnerability scans after patching, then test externally that previously reachable sensitive ColdFusion paths are blocked or return expected restricted responses. Review ColdFusion update logs for successful installation and restart, and confirm no duplicate or legacy ColdFusion instances remain running on alternate ports or older application roots.

Typical attack path

1. Scan the internet or target ranges for Adobe ColdFusion servers and exposed CFIDE/cf_scripts paths.
2. Fingerprint ColdFusion version, update level, or behavior through HTTP responses, headers, error pages, and accessible component endpoints.
3. Send crafted unauthenticated requests to a vulnerable ColdFusion endpoint that lacks proper access control.
4. Achieve code execution or write/execute server-side script in the context of the ColdFusion service account.
5. Deploy a lightweight web shell or command-execution stager to maintain interactive access.
6. Run discovery commands, read application configuration, and collect credentials, keys, database connection strings, or source code.
7. Use obtained credentials and network position for additional access, data theft, persistence, or further compromise.

How to detect it

Review historical web access logs, reverse-proxy logs, WAF logs, and load-balancer logs for unauthenticated requests to ColdFusion administrative, CFIDE, adminapi, cf_scripts, and CFC endpoints, especially POST requests, unusual method parameters, encoded traversal sequences, unexpected 200 responses, or error responses followed by additional probing. Review ColdFusion logs such as application.log, exception.log, server.log, coldfusion-out.log, coldfusion-error.log, audit.log, and update logs for errors or component invocations around suspicious HTTP activity. On the host, inspect ColdFusion web roots and CFIDE/cf_scripts directories for recently created or modified server-side files, especially small .cfm, .cfc, .jsp, .jspx, .jar, .war, or .class files. Correlate process telemetry for ColdFusion, coldfusion.exe, cfusion, jrun, or Java spawning command interpreters, scripting engines, download tools, archive utilities, or network tools. Check outbound connections from ColdFusion servers to unfamiliar IPs, newly observed domains, paste sites, file-sharing services, or command-and-control-like infrastructure. If exploitation is suspected, preserve disk images and logs before remediation where possible, collect memory or process listings, and rotate credentials that may have been readable by the ColdFusion service account.

• /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc
• /CFIDE/adminapi/
• /CFIDE/administrator/
• /CFIDE/wizards/
• /CFIDE/componentutils/
• method=zip
• method=mkdir
• method=upload
• method=download
• method=delete
• ..%2fCFIDE
• ..%5cCFIDE
• /opt/coldfusion/cfusion/wwwroot/CFIDE/
• /opt/coldfusion/cfusion/wwwroot/cf_scripts/
• \cfusion\wwwroot\CFIDE\
• \cfusion\wwwroot\cf_scripts\
• coldfusion.exe
• jrun.exe
• cfusion/runtime/bin
• ParentImage=*coldfusion.exe* Image=*cmd.exe
• ParentImage=*coldfusion.exe* Image=*powershell.exe
• ParentImage=*java.exe* Image=*cmd.exe
• ParentImage=*java.exe* Image=*powershell.exe
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• curl http
• wget http
• Runtime.getRuntime
• ProcessBuilder
• javax.script.ScriptEngineManager

What your security team should do

• Immediately inventory all internet-facing and internally exposed Adobe ColdFusion instances and prioritize any 2018 Update 15 or earlier and 2021 Update 5 or earlier systems.
• Patch or isolate vulnerable ColdFusion servers on an emergency basis because this vulnerability is in the CISA KEV catalog, was due for remediation by 2023-04-05, has active exploitation, and has a very high EPSS probability.
• If immediate patching is not possible, remove public access to CFIDE, adminapi, administrator, cf_scripts, RDS, and unnecessary ColdFusion endpoints using network ACLs, reverse proxy policy, or WAF controls.
• Hunt for prior exploitation before and after patching, focusing on web requests to ColdFusion component paths, suspicious file creation in web roots, and child processes spawned by ColdFusion or Java runtimes.
• Search for newly created .cfm, .cfc, .jsp, .jspx, .class, .jar, .war, .aspx, or script files in ColdFusion web-accessible directories and compare against a known-good baseline.
• Rotate credentials and secrets stored on or accessible from affected ColdFusion servers if exploitation is suspected, including database passwords, API keys, service-account credentials, and signing keys.
• Apply Adobe ColdFusion lockdown guidance, disable unused services such as RDS, remove samples, and enforce least privilege for the ColdFusion service account.
• Reconcile vulnerability-management data that maps this CVE to joomla/joomla-cms with deployed assets, because the CVE description is for Adobe ColdFusion and incorrect product mapping can leave real exposure unpatched.