CVE-2023-26360 KEVPublic exploit High · 8.6 EPSS 97.3%
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe · ColdFusion
Summary
The flaw is an Improper Access Control vulnerability in Adobe ColdFusion, affecting versions 2018 Update 15 and earlier and 2021 Update 5 and earlier. An attacker who can reach the affected ColdFusion instance over the network can achieve arbitrary code execution in the context of the current user, with no authentication or user interaction required.
Official description · NVD
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
69.0 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 9/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What they do
What can follow
- Plant a web shell for remote controlT1505.003 · Web Shell
- Group Policy ModificationT1484.001 · Group Policy Modification
- Disguise malicious files as legitimateT1036.005 · Match Legitimate Resource Name or Location
- Dump passwords from Windows memoryT1003.001 · LSASS Memory
- Scan for other services on the networkT1046 · Network Service Discovery
- Talk to the attacker over web trafficT1071.001 · Web Protocols
- Download more tools onto the systemT1105 · Ingress Tool Transfer
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 9 days before it was disclosed. Public exploit code (Metasploit) was available 9 days before disclosure.
- Added to CISA KEVEU database agrees8 days before
- Disclosedday 0
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
9 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 9Initial AccessTA0001
MITRE CTID mapping of the KEV entry · how it is exploited
This vulnerability gives an adversary access through exploitation of a public-facing server.
ExecutionTA0002
JavaScript T1059.007
MITRE CTID mapping of the KEV entry · primary impact
PersistenceTA0003
Web Shell T1505.003
MITRE CTID mapping of the KEV entry · follow-on activity
Privilege EscalationTA0004
MITRE CTID mapping of the KEV entry · follow-on activity
Stealth
MITRE CTID mapping of the KEV entry · follow-on activity
Credential AccessTA0006
LSASS Memory T1003.001
MITRE CTID mapping of the KEV entry · follow-on activity
DiscoveryTA0007
MITRE CTID mapping of the KEV entry · follow-on activity
Command and ControlTA0011
Web Protocols T1071.001
MITRE CTID mapping of the KEV entry · follow-on activity
Ingress Tool Transfer T1105
MITRE CTID mapping of the KEV entry · follow-on activity
Detection
0 rules for this CVE · 471 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2023-26360 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploit Public-Facing ApplicationT1190149 general rules
- Arcadyan Router Exploitationscriticaltest
- Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
- Citrix Netscaler Attack CVE-2019-19781criticaltest
- Confluence Exploitation CVE-2019-3398criticaltest
- CVE-2010-5278 Exploitation Attemptcriticaltest
- CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
- CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
- CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest
JavaScriptT1059.00729 general rules
- Adwind RAT / JRAThightest
- Adwind RAT / JRAT File Artifacthightest
- Csc.EXE Execution Form Potentially Suspicious Parenthightest
- Cscript/Wscript Uncommon Script Extension Executionhightest
- HackTool - CACTUSTORCH Remote Thread Creationhightest
- HackTool - Koadic Executionhightest
- HTML Help HH.EXE Suspicious Child Processhightest
- JXA In-memory Execution Via OSAScripthightest
Web ShellT1505.00335 general rules
- Certificate Request Export to Exchange Webservercriticaltest
- CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploitcriticaltest
- Mailbox Export to Exchange Webservercriticaltest
- Oracle WebLogic Exploitcriticaltest
- Solarwinds SUPERNOVA Webshell Accesscriticaltest
- Webshell Remote Command Executioncriticaltest
- WordPress Wp2shell Webshell Plugin Accesscriticalexperimental
- Antivirus - Web Shell Detection Signaturehightest
Group Policy ModificationT1484.0016 general rules
- Group Policy Abuse for Privilege Additionmediumtest
- Modify Group Policy Settingsmediumtest
- Modify Group Policy Settings - ScriptBlockLoggingmediumtest
- Startup/Logon Script Added to Group Policy Objectmediumtest
- Windows Default Domain GPO Modificationmediumexperimental
- Windows Default Domain GPO Modification via GPMEmediumexperimental
Match Legitimate Resource Name or LocationT1036.00524 general rules
- Exploit for CVE-2015-1641criticalstable
- Greenbug Espionage Group Indicatorscriticaltest
- RedSun - TieringEngineService.exe Detected as EICAR Test Filecriticalexperimental
- RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dircriticalexperimental
- Flash Player Update from Suspicious Locationhightest
- Lazarus System Binary Masqueradinghightest
- Potential MsiExec Masqueradinghightest
- Small Sieve Malware File Indicator Creationhightest
LSASS MemoryT1003.00179 general rules
- Antivirus - Password Dumper Signaturecriticalstable
- APT31 Judgement Panda Activitycriticaltest
- HackTool - Credential Dumping Tools Named Pipe Createdcriticaltest
- HackTool - Dumpert Process Dumper Default Filecriticaltest
- HackTool - Dumpert Process Dumper Executioncriticaltest
- HackTool - Inveigh Executioncriticaltest
- HackTool - SafetyKatz Executioncriticaltest
- HackTool - Windows Credential Editor (WCE) Executioncriticaltest
Network Service DiscoveryT104620 general rules
- HackTool - winPEAS Executionhightest
- HackTool - WinPwn Executionhightest
- HackTool - WinPwn Execution - ScriptBlockhightest
- Grixba Malware Reconnaissance Activityhighexperimental
- OpenCanary - Host Port Scan (SYN Scan)highexperimental
- OpenCanary - NMAP FIN Scanhighexperimental
- OpenCanary - NMAP NULL Scanhighexperimental
- OpenCanary - NMAP OS Scanhighexperimental
Web ProtocolsT1071.00142 general rules
- Ursnif Malware C2 URL Patterncriticalstable
- HackTool - BabyShark Agent Default URL Patterncriticaltest
- PwnDrp Accesscriticaltest
- Ursnif Malware Download URL Patternhighstable
- APT User Agenthightest
- APT40 Dropbox Tool User Agenthightest
- Bitsadmin to Uncommon IP Server Addresshightest
- Bitsadmin to Uncommon TLDhightest
Ingress Tool TransferT110587 general rules
- Greenbug Espionage Group Indicatorscriticaltest
- Pandemic Registry Keycriticaltest
- Curl Download And Execute Combinationhightest
- File Download And Execution Via IEExec.EXEhightest
- File Download From IP Based URL Via CertOC.EXEhightest
- File Download Using Notepad++ GUP Utilityhightest
- File Download Via Bitsadmin To A Suspicious Target Folderhightest
- File Download Via Windows Defender MpCmpRun.EXEhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX