CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2023-38203

CVSS 9.8v3.1pub. 2023-07-20upd. 2025-10-23

Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Adobe Coldfusion

    APP
    Adobe
    201820212023

CISA KEV — detailsi

Vendori
Adobe ↗
Producti
ColdFusion
Added to KEVi
January 8, 2024
Remediation deadline (US Federal)i
January 29, 2024(overdue)
Ransomwarei
Active ransomware campaigns exploit this vulnerability
Required action (CISA)i

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 29 stycznia 2024
Tags
RCEDeserialization
CWE
References

Related vulnerabilities

CVE-2026-48282CRITICAL10.0⚠ KEVPL ✓same product

Adobe ColdFusion: Path Traversal umożliwiający zdalne wykonanie kodu (RCE)

CVE-2023-29300CRITICAL9.8⚠ KEVPL ✓same product

Adobe ColdFusion — RCE przez Deserialization of Untrusted Data

CVE-2023-26359CRITICAL9.8⚠ KEVPL ✓same product

Adobe ColdFusion — krytyczna podatność deserialization umożliwiająca RCE

CVE-2018-15961CRITICAL9.8⚠ KEVPL ✓same product

Adobe ColdFusion — nieograniczony upload pliku prowadzący do RCE

CVE-2018-4939CRITICAL9.8⚠ KEVPL ✓same product

Adobe ColdFusion — RCE przez Deserialization niezaufanych danych