Security News > 2023 > March > CISA Issues Urgent Warning: Adobe ColdFusion Vulnerability Exploited in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency on March 15 added a security vulnerability impacting Adobe ColdFusion to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation.

The critical flaw in question is CVE-2023-26360, which could be exploited by a threat actor to achieve arbitrary code execution.

"Adobe ColdFusion contains an improper access control vulnerability that allows for remote code execution," CISA said.

It's worth noting that CVE-2023-26360 also affects ColdFusion 2016 and ColdFusion 11 installations, but are no longer supported by the software company as they have reached end-of-life.

While the exact details surrounding the nature of the attacks are unknown, Adobe said in an advisory that it's aware of the flaw being "Exploited in the wild in very limited attacks."

Charlie Arehart, a security researcher credited with discovering and reporting the flaw alongside Pete Freitag, described it as a "Grave" issue that could result in "Arbitrary code execution" and "Arbitrary file system read.".

News URL

https://thehackernews.com/2023/03/cisa-issues-urgent-warning-adobe.html