PatchSiren cyber security CVE debrief
CVE-2023-26360 Adobe CVE debrief
CVE-2023-26360 is an Adobe ColdFusion deserialization of untrusted data vulnerability that CISA listed in the Known Exploited Vulnerabilities catalog on 2023-03-15. Because CISA marked it as known exploited and set a remediation due date of 2023-04-05, ColdFusion administrators should treat it as a high-priority patch item and follow Adobe’s update instructions.
- Vendor
- Adobe
- Product
- ColdFusion
- CVSS
- Unknown
- CISA KEV
- Listed
- Original CVE published
- 2023-03-15
- Original CVE updated
- 2023-03-15
- Advisory published
- 2023-03-15
- Advisory updated
- 2023-03-15
Who should care
Adobe ColdFusion administrators, application owners, platform teams, and incident responders responsible for ColdFusion deployments, especially internet-facing or business-critical servers.
Technical summary
The supplied corpus describes this issue as a deserialization of untrusted data vulnerability in Adobe ColdFusion. CISA’s KEV entry indicates it was known exploited as of 2023-03-15 and directs organizations to apply updates per vendor instructions. The provided sources do not include additional technical exploit details or a CVSS score.
Defensive priority
High — CISA KEV-listed and known exploited; apply vendor updates as soon as possible and align remediation with the 2023-04-05 due date.
Recommended defensive actions
- Inventory all Adobe ColdFusion instances and identify affected versions and deployment locations.
- Apply Adobe’s vendor updates and follow the remediation guidance referenced by CISA KEV.
- Prioritize exposed, internet-facing, and business-critical ColdFusion servers for immediate remediation.
- If patching is delayed, use vendor-approved compensating controls and restrict access to the affected systems.
- Review relevant logs and alerting for suspicious ColdFusion activity and escalate potential incident-response cases promptly.
Evidence notes
The official CISA KEV record for this CVE lists Adobe ColdFusion, classifies it as known exploited, sets dateAdded to 2023-03-15, dueDate to 2023-04-05, and states the required action as applying updates per vendor instructions. The KEV metadata also references Adobe’s security advisory and the NVD detail page. No CVSS score was included in the supplied corpus, so prioritization here is based on KEV status and the remediation deadline.
Official resources
-
CVE-2023-26360 CVE record
CVE.org
-
CVE-2023-26360 NVD detail
NVD
-
CISA Known Exploited Vulnerabilities catalog
CISA - Apply updates per vendor instructions.
-
Source item URL
cisa_kev
Public advisory summary based on official CISA KEV, CVE.org, and NVD records; no exploit instructions included.