Loading story…
Attackers exploited Adobe ColdFusion vulnerabilities by chaining an access-control bypass, CVE-2023-29298, with a deserialization flaw, CVE-2023-38203, to achieve remote code execution. Rapid7 observed attacks in multiple customer environments beginning July 13, 2023. An exploit published and subsequently removed by Project Discovery apparently exposed a new zero-day rather than the previously patched CVE-2023-29300. Adobe patched CVE-2023-38203 on July 14, but Rapid7 confirmed that the original CVE-2023-29298 fix remained bypassable. Adobe addressed that remaining bypass as CVE-2023-38205 on July 19, and Rapid7 verified that the new patch worked.
FortiGuard Labs subsequently reported more than 50,000 unique IPS detections on January 9, 2024, highlighting widespread exploitation attempts involving ColdFusion vulnerabilities, including CVE-2023-26347; successful access-control bypasses could expose ColdFusion Administrator endpoints. CVE-2023-29298, CVE-2023-38203 and CVE-2023-38205 are listed in CISA’s Known Exploited Vulnerabilities catalog. Observed attackers used encoded PowerShell to create a ColdFusion webshell, make outbound requests and conduct domain-trust discovery. Organizations should apply Adobe’s vendor-recommended security updates, restrict access to administrative endpoints and investigate suspected webshell activity; Rapid7 also recommended blocking oastify[.]com.
See which actors are running it and whether you're in range.
11 events from the most recent confirmed update back to the earliest known activity.
On January 9, 2024, FortiGuard Labs reported continued attacks against Adobe ColdFusion, with more than 50,000 unique intrusion prevention system detections. The outbreak report highlighted security bypass vulnerabilities that could expose ColdFusion Administrator endpoints.
CISA added the actively exploited ColdFusion deserialization vulnerability CVE-2023-38203 to its Known Exploited Vulnerabilities catalog on January 8, 2024.
FortiGuard's report dates the announcement of the CVE-2023-26347 access control bypass and Adobe's corresponding patches to November 28, 2023.
CISA added CVE-2023-38205 and CVE-2023-29298 to its Known Exploited Vulnerabilities catalog on July 20, 2023.
Adobe released ColdFusion updates addressing the access control patch bypass as CVE-2023-38205 on July 19, 2023, and Rapid7 confirmed the new fix worked. Adobe stated that the vulnerability had been exploited in limited attacks.
On July 17, 2023, Rapid7 determined that Adobe's July 11 fix for CVE-2023-29298 was incomplete and that a trivially modified exploit still worked against the July 14 release. Rapid7 notified Adobe of the incomplete patch.
Adobe released an out-of-band ColdFusion patch for CVE-2023-38203 on July 14, 2023. The update expanded the deserialization denylist to block the gadget used in Project Discovery's exploit, but left the CVE-2023-29298 access control bypass unresolved.
Rapid7 began observing attacks on July 13, 2023, apparently chaining CVE-2023-29298 with a secondary vulnerability consistent with CVE-2023-38203 to achieve remote code execution. Attackers used encoded PowerShell to deploy ColdFusion webshells and performed outbound requests and domain-trust discovery.
Around July 12, 2023, Project Discovery published and subsequently removed a ColdFusion exploit. Rapid7 assessed that it exposed a new zero-day exploit chain rather than the already-patched CVE-2023-29300, using a deserialization gadget absent from Adobe's initial denylist.
On July 11, 2023, Rapid7 disclosed the CVE-2023-29298 access control bypass in coordination with Adobe. Adobe released fixes for that vulnerability and other ColdFusion flaws, including the CVE-2023-29300 deserialization vulnerability that allowed arbitrary code execution.
FortiGuard Labs observed attackers exploiting ColdFusion deserialization vulnerabilities to establish reverse shells and deploy XMRig, Satan DDoS/Lucifer, RudeMiner, and BillGates/Setag. Base64-encoded download payloads retrieved malware from a shared public HTTP file server, enabling cryptocurrency mining, DDoS attacks, and remote control.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
fortiguard.com
Open sourcerapid7.com
Open sourcehelpx.adobe.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited Adobe ColdFusion vulnerabilities that can allow arbitrary code execution without user interaction. Adobe confirmed limited exploitation of **CVE-2023-26360** in March 2023, and FortiGuard Labs subsequently reported blocking several hundred attempts targeting the flaw. FortiGuard identified both CVE-2023-26360 and CVE-2023-26359 as deserialization vulnerabilities and reported that CISA added both to its Known Exploited Vulnerabilities catalog. A separate SecureLayer7 analysis reported CVE-2023-26360 exploitation against U.S. Federal Civilian Executive Branch agencies and, citing Threatrecon, attributed exploitation to the Chinese government-sponsored group SectorB01. CVE-2023-26360 affects **ColdFusion 2018 and 2021**, enabling unauthenticated attackers to read arbitrary files and execute code. SecureLayer7 traced the issue to unsafe handling of attacker-controlled JSON metadata, allowing arbitrary file paths to reach ColdFusion’s template-loading and compilation mechanisms. Its demonstrated execution chain placed a ColdFusion execution tag in a log file, then caused the server to process that file. Patch analysis identified a new `allowNonCFCDeserialization` control intended to restrict the unsafe behavior. Organizations should prioritize Adobe’s security updates and investigate signs of compromise on exposed servers; FortiGuard reported that IPS protection for CVE-2023-26359 remained under investigation at the time of its alert.
Oct 9, 2026
Adobe issued urgent ColdFusion updates after multiple severe vulnerabilities were disclosed across ColdFusion 2025 and 2023, including several flaws that can lead to arbitrary code execution. The most serious newly listed issue, **CVE-2026-48362**, is an unauthenticated OS command injection bug rated `CVSS 10.0`, while **CVE-2026-48273** was rated `9.9` for eval injection. Additional high-severity flaws include **CVE-2026-71387** (incorrect authorization, `CVSS 8.8`) and **CVE-2026-71386** (cross-site scripting, `CVSS 8.8`), alongside other issues affecting authorization, memory safety, denial of service, and sensitive memory exposure. Adobe said affected versions include ColdFusion 2025 up to `2025.0.11` and ColdFusion 2023 up to `2023.0.22`, and directed customers to upgrade to **2025.0.12** or **2023.0.23**. The warnings follow earlier reports that attackers rapidly exploited at least one maximum-severity ColdFusion flaw, **CVE-2026-48282**, a path traversal vulnerability that can enable arbitrary code execution without user interaction. Researchers said exploitation began within hours of public disclosure, and Shadowserver data cited **775** internet-exposed ColdFusion instances, highlighting the reachable attack surface. Adobe said it had not observed active exploitation of the latest August issues, but advised administrators to patch immediately, restrict access to the administrative network zone and portal, limit network exposure, monitor logs for unauthorized access attempts, and accelerate remediation as ColdFusion remains a high-value target.
Aug 12, 2026
Adobe reported active exploitation of four critical vulnerabilities in ColdFusion affecting Windows, Macintosh, and UNIX systems. Advisory **APSA13-01**, issued in January 2013, identified CVE-2013-0625 and CVE-2013-0632 as remote authentication-bypass flaws that could enable server takeover, CVE-2013-0629 as a restricted-directory access vulnerability, and CVE-2013-0631 as an information-disclosure flaw involving a compromised server. The CVE record for CVE-2013-0629 specifies that ColdFusion 9.0, 9.0.1, 9.0.2, and 10 are vulnerable when a password is not configured and confirms exploitation in January 2013. Adobe released **priority 1 security hotfixes** for ColdFusion 10, 9.0.2, 9.0.1, and 9.0, with installation instructions in bulletin **APSB13-03**. Administrators should apply the applicable fixes and restrict administrative access. For unsupported versions, including ColdFusion 8.x and earlier, Adobe recommended configuring password protection, disabling Remote Development Services after setting credentials, restricting administrative access, and removing unknown or unnecessary components.
Oct 9, 2026