PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-26360 Adobe CVE debrief

CVE-2023-26360 is an Adobe ColdFusion deserialization of untrusted data vulnerability that CISA listed in the Known Exploited Vulnerabilities catalog on 2023-03-15. Because CISA marked it as known exploited and set a remediation due date of 2023-04-05, ColdFusion administrators should treat it as a high-priority patch item and follow Adobe’s update instructions.

Vendor
Adobe
Product
ColdFusion
CVSS
HIGH 8.6
CISA KEV
Listed
Original CVE published
2023-03-15
Original CVE updated
2023-03-15
Advisory published
2023-03-15
Advisory updated
2023-03-15

Who should care

Adobe ColdFusion administrators, application owners, platform teams, and incident responders responsible for ColdFusion deployments, especially internet-facing or business-critical servers.

Technical summary

The supplied corpus describes this issue as a deserialization of untrusted data vulnerability in Adobe ColdFusion. CISA’s KEV entry indicates it was known exploited as of 2023-03-15 and directs organizations to apply updates per vendor instructions. The provided sources do not include additional technical exploit details or a CVSS score.

Defensive priority

High — CISA KEV-listed and known exploited; apply vendor updates as soon as possible and align remediation with the 2023-04-05 due date.

Recommended defensive actions

  • Inventory all Adobe ColdFusion instances and identify affected versions and deployment locations.
  • Apply Adobe’s vendor updates and follow the remediation guidance referenced by CISA KEV.
  • Prioritize exposed, internet-facing, and business-critical ColdFusion servers for immediate remediation.
  • If patching is delayed, use vendor-approved compensating controls and restrict access to the affected systems.
  • Review relevant logs and alerting for suspicious ColdFusion activity and escalate potential incident-response cases promptly.

Evidence notes

The official CISA KEV record for this CVE lists Adobe ColdFusion, classifies it as known exploited, sets dateAdded to 2023-03-15, dueDate to 2023-04-05, and states the required action as applying updates per vendor instructions. The KEV metadata also references Adobe’s security advisory and the NVD detail page. No CVSS score was included in the supplied corpus, so prioritization here is based on KEV status and the remediation deadline.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-26360 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-26360

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-26360 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-26360

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.