Security feed

24 October 2026

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Unrestricted File Upload Vulnerability

Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution. CISA required action: Apply updates per vendor instructions.

ColdFusion CVE-2018-15961

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-15961

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-15961
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2976 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:27:01 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution. CISA required action: Apply updates per vendor instructions.

ColdFusion CVE-2018-4939

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-4939

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-4939
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2975 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:27:00 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Authentication Bypass Vulnerability

An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access. CISA required action: Apply updates per vendor instructions.

ColdFusion CVE-2013-0632

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-0632

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-0632
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2855 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:47 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Directory Traversal Vulnerability

Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories. CISA required action: Apply updates per vendor instructions.

ColdFusion CVE-2013-0629

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-0629

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-0629
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2777 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:24:06 GMT
Publisher date: Mon, 07 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Authentication Bypass Vulnerability

Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access. CISA required action: Apply updates per vendor instructions.

ColdFusion CVE-2013-0625

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-0625

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-0625
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2776 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:24:05 GMT
Publisher date: Mon, 07 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Information Disclosure Vulnerability

Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server. CISA required action: Apply updates per vendor instructions.

ColdFusion CVE-2013-0631

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-0631

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-0631
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2774 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:24:04 GMT
Publisher date: Mon, 07 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Directory Traversal Vulnerability

A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files. CISA required action: Apply updates per vendor instructions.

ColdFusion CVE-2010-2861

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2010-2861

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2010-2861
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2747 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:23:48 GMT
Publisher date: Fri, 25 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.

ColdFusion CVE-2023-26360

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2023-26360

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2023-26360
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1362 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:01:41 GMT
Publisher date: Wed, 15 Mar 2023 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Improper Access Control Vulnerability

Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ColdFusion CVE-2023-38205

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2023-38205

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2023-38205
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1282 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:59:10 GMT
Publisher date: Thu, 20 Jul 2023 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Improper Access Control Vulnerability

ColdFusion CVE-2023-29298

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2023-29298

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2023-29298
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1281 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:59:09 GMT
Publisher date: Thu, 20 Jul 2023 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ColdFusion CVE-2023-26359

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2023-26359

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2023-26359
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1272 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:59:04 GMT
Publisher date: Mon, 21 Aug 2023 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ColdFusion CVE-2023-38203

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2023-38203

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2023-38203
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1200 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:58:19 GMT
Publisher date: Mon, 08 Jan 2024 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

ColdFusion CVE-2023-29300

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2023-29300

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2023-29300
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1199 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:57:33 GMT
Publisher date: Mon, 08 Jan 2024 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Improper Access Control Vulnerability

Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ColdFusion CVE-2024-20767

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2024-20767

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2024-20767
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1026 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:55:00 GMT
Publisher date: Mon, 16 Dec 2024 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Deserialization Vulnerability

Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ColdFusion CVE-2017-3066

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-3066

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-3066
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #480 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:46:39 GMT
Publisher date: Mon, 24 Feb 2025 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Path Traversal Vulnerability

Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

ColdFusion CVE-2026-48282

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2026-48282

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-48282
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #128 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:41:25 GMT
Publisher date: Tue, 07 Jul 2026 00:00:00 GMT

Read the original announcement