Adobe ColdFusion

18 known vulnerabilities in Adobe ColdFusion, 7 critical, 9 actively exploited, with patch priority, exploit likelihood and the news covering them.

Recently exploited

  • CVE-2026-48282 CVSS 10.0 critical · actively exploited Adobe ColdFusion Path Traversal Vulnerability
  • CVE-2024-20767 CVSS 7.4 high · actively exploited Adobe ColdFusion Improper Access Control Vulnerability
  • CVE-2023-38205 CVSS 7.5 high · actively exploited Adobe ColdFusion Improper Access Control Vulnerability
  • CVE-2023-38203 CVSS 9.8 critical · actively exploited Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
  • CVE-2023-29300 CVSS 9.8 critical · actively exploited Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
  • CVE-2023-29298 CVSS 7.5 high · actively exploited Adobe ColdFusion Improper Access Control Vulnerability
  • CVE-2023-26360 CVSS 8.6 high · actively exploited Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
  • CVE-2023-26359 CVSS 9.8 critical · actively exploited Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
  • CVE-2018-15961 CVSS 9.8 critical · actively exploited Adobe ColdFusion Unrestricted File Upload Vulnerability

Latest vulnerabilities

  • CVE-2026-76190 CVSS 8.6 high ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that…
  • CVE-2026-76002 CVSS 6.1 medium ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL…
  • CVE-2026-76000 CVSS 6.5 medium ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker…
  • CVE-2026-75999 CVSS 8.4 high ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the…
  • CVE-2026-75998 CVSS 7.5 high ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could…
  • CVE-2026-75993 CVSS 8.5 high ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject…
  • CVE-2026-75746 CVSS 9.1 critical ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could…
  • CVE-2026-48273 CVSS 9.9 critical ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that…
  • CVE-2026-83961 CVSS 7.1 high ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage…
  • CVE-2026-48282 CVSS 10.0 critical · actively exploited Adobe ColdFusion Path Traversal Vulnerability
  • CVE-2024-20767 CVSS 7.4 high · actively exploited Adobe ColdFusion Improper Access Control Vulnerability
  • CVE-2023-38205 CVSS 7.5 high · actively exploited Adobe ColdFusion Improper Access Control Vulnerability
  • CVE-2023-38203 CVSS 9.8 critical · actively exploited Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
  • CVE-2023-29300 CVSS 9.8 critical · actively exploited Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
  • CVE-2023-29298 CVSS 7.5 high · actively exploited Adobe ColdFusion Improper Access Control Vulnerability
  • CVE-2023-26360 CVSS 8.6 high · actively exploited Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
  • CVE-2023-26359 CVSS 9.8 critical · actively exploited Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
  • CVE-2018-15961 CVSS 9.8 critical · actively exploited Adobe ColdFusion Unrestricted File Upload Vulnerability