Adobe ColdFusion known exploited vulnerabilities
We track 22 CVEs in Adobe ColdFusion. 16 of them are on CISA's Known Exploited Vulnerabilities catalog, meaning CISA has evidence of exploitation in the wild (listed 2021–2021). CISA flags 3 of them as used in ransomware campaigns. The most recent is CVE-2026-48325.
Also listed as: ColdFusion 2023, ColdFusion 2025 · ColdFusion 2025, ColdFusion 2023. CISA, NVD and vendor advisories name the same product differently; each CVE page keeps the wording from its source.
- CVEs tracked
- 22
- On CISA KEV
- 16
- Ransomware use
- 3
- Rated critical
- 16
Every Adobe ColdFusion CVE we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-48325 Adobe ColdFusion missing authentication — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.6% | — | — |
| CVE-2026-48322 Adobe ColdFusion code injection — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 1.2% | — | — |
| CVE-2026-48321 Adobe ColdFusion authorization bypass — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.4% | — | — |
| CVE-2026-48319 Adobe ColdFusion path traversal — CVSS 9.1write-up | [ CRITICAL ] | 9.1 | 1.4% | — | — |
| CVE-2026-48284 Adobe ColdFusion input-validation failure — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 0.5% | — | — |
| CVE-2026-48318 Adobe ColdFusion path traversalwrite-up | [ CRITICAL ] | 9.9 | 1.1% | — | — |
| CVE-2026-48282 Adobe ColdFusion path-traversal to arbitrary code executionwrite-up | [ CRITICAL ] | 10.0 | 42.4% | ||
| CVE-2017-3066 Adobe ColdFusion Deserialization Vulnerability | [ CRITICAL ] | 9.8 | 90.6% | ||
| CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability | [ HIGH ] | 7.4 | 98.5% | ||
| CVE-2023-38203 Adobe ColdFusion Deserialization of Untrusted Data Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 97.1% | ||
| CVE-2023-29300 Adobe ColdFusion Deserialization of Untrusted Data Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2023-26359 Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 17.0% | ||
| CVE-2023-38205 Adobe ColdFusion Improper Access Control Vulnerability | [ HIGH ] | 7.5 | 99.8% | ||
| CVE-2023-29298 Adobe ColdFusion Improper Access Control Vulnerability | [ HIGH ] | 7.5 | 99.8% | ||
| CVE-2023-26360 Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | [ HIGH ] | 8.6 | 97.3% | ||
| CVE-2010-2861 Adobe ColdFusion Directory Traversal Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 99.7% | ||
| CVE-2013-0631 Adobe ColdFusion Information Disclosure Vulnerability | [ HIGH ] | 7.5 | 66.4% | ||
| CVE-2013-0629 Adobe ColdFusion Directory Traversal Vulnerability | [ HIGH ] | 7.5 | 65.8% | ||
| CVE-2013-0625 Adobe ColdFusion Authentication Bypass Vulnerability | [ CRITICAL ] | 9.8 | 93.8% | ||
| CVE-2013-0632 Adobe ColdFusion Authentication Bypass Vulnerability | [ CRITICAL ] | 9.8 | 93.6% | ||
| CVE-2018-4939 Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 62.0% | ||
| CVE-2018-15961 Adobe ColdFusion Unrestricted File Upload Vulnerability | [ CRITICAL ] | 9.8 | 100.0% |
Sorted by date added to KEV. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else. Machine-readable: /api/v1/vendors/adobe.json.
Our Adobe ColdFusion coverage
Other Adobe products
Every row links to its CVE record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker or compare KEV catalogs.