August 21, 2023 · Applied Cybernetics Group
CVE-2023-26359 — Adobe ColdFusion
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
- Added to KEV
2023-08-21- Federal due date
2023-09-11- Vendor
- Adobe
- Product
- ColdFusion
- EPSS
- 99.1th percentile (score 0.791, as of
2026-06-08) - NVD CVSS v3.1
- —
- Ransomware use
- Unknown
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2023-26359
CISA short description
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.