CVE-2023-26360

Adobe ColdFusion Improper Access Control Arbitrary code execution

8.6 HighIn KEVPublic exploit

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

97.3%Up 96.9 points since Mar 24, 2023

What each source reports

CVE List Score used 8.6

Adobe ColdFusion Improper Access Control Arbitrary code execution

Record: CVE-2023-26360
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2023-30181 8.6

Record: EUVD-2023-30181
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-p86r-cr5m-73hp 8.6

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are...

Record: GHSA-p86r-cr5m-73hp
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-284
Updated: 2026-11-02

CISA KEV No score

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.

Record: CVE-2023-26360
Weakness: CWE-284
Updated: 2026-11-02

NVD 8.6

Record: CVE-2023-26360
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

Affected products

adobe coldfusion

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Adobe ColdFusion Unauthenticated Remote Code Execution	2023-03-14
PoC in GitHub	yosef0x01/CVE-2023-26360	2023-12-26
PoC in GitHub	jakabakos/CVE-2023-26360-adobe-coldfusion-rce-exploit	2024-05-14
PoC in GitHub	CuriousLearnerDev/ColdFusion_EXp	2024-09-03
PoC in GitHub	H3rm1tR3b0rn/CVE-2023-26360-RCE	2025-10-28
PoC in GitHub	joaoaugustom/Adobe_ColdFusion_RCE_Unauthenticated	2026-05-16
PoC in GitHub	DefaultCh40s/CVE-2023-26360	2026-11-04
Nuclei	Adobe ColdFusion - Local File Read
Metasploit	Adobe ColdFusion Unauthenticated Arbitrary File Read

History

History
Recorded	Changed	Sources
Nov 5, 2026	exploits	PoC in GitHub
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-26360 is a high vulnerability (CVSS 8.6) in Adobe Coldfusion, published March 23, 2023. CISA lists it as known to be exploited, since March 15, 2023. EUVD reports exploitation since March 15, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.3%, the 99th percentile. No source names a fixed version.