ByteOS

Product:ColdFusion

Added At:15 Mar, 2023

Due At:05 Apr, 2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.

Used in Ransomware

Unknown

CWE

CWE-284

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html; https://nvd.nist.gov/vuln/detail/CVE-2023-26360

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:23 Mar, 2023 | 00:00

Updated At:21 Oct, 2025 | 23:15

▼CVE Numbering Authority (CNA)

Adobe ColdFusion Improper Access Control Arbitrary code execution

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Affected Products

Vendor

Product

ColdFusion

Versions

Affected

From unspecified through CF2018U15 (custom)
From unspecified through CF2021U5 (custom)
From unspecified through None (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-284	Improper Access Control (CWE-284)

Type: CWE

CWE ID: CWE-284

Description: Improper Access Control (CWE-284)

Metrics

Version	Base score	Base severity	Vector
3.1	8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Version: 3.1

Base score: 8.6

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html	N/A
http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html	N/A

Hyperlink: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html

Resource: N/A

Hyperlink: http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html	x_transferred
http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html	x_transferred

Hyperlink: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html

Resource:

x_transferred

Hyperlink: http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

kev

dateAdded:

2023-03-15

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360

Timeline

Event	Date
CVE-2023-26360 added to CISA KEV	2023-03-15 00:00:00

Event: CVE-2023-26360 added to CISA KEV

Date: 2023-03-15 00:00:00

References

Hyperlink	Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360	government-resource

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360

Resource:

government-resource

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:psirt@adobe.com

Published At:23 Mar, 2023 | 20:15

Updated At:23 Oct, 2025 | 11:12

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2023-03-15	2023-04-05	Adobe ColdFusion Deserialization of Untrusted Data Vulnerability	Apply updates per vendor instructions.

Date Added: 2023-03-15

Due Date: 2023-04-05

Vulnerability Name: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 8.6

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE Matches

cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*

>>coldfusion>>2021

cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*

>>coldfusion>>2021

cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*

>>coldfusion>>2021

cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*

>>coldfusion>>2021

cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*

>>coldfusion>>2021

cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*

>>coldfusion>>2021

Weaknesses

CWE ID	Type	Source
CWE-284	Secondary	psirt@adobe.com
NVD-CWE-Other	Primary	nvd@nist.gov

CWE ID: CWE-284

Type: Secondary

Source: psirt@adobe.com

CWE ID: NVD-CWE-Other

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html	psirt@adobe.com	Exploit Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html	psirt@adobe.com	Patch Vendor Advisory
http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360	134c704f-9b21-4f2e-91b3-4a467353bcc0	Third Party Advisory US Government Resource

Hyperlink: http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html

Source: psirt@adobe.com

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html

Source: psirt@adobe.com

Resource:

Patch

Vendor Advisory

Hyperlink: http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

Third Party Advisory

US Government Resource

Similar CVEs

739Records found

CVE-2024-34107

Matching Score-10

Matching Score-10

CVSS Score-5.3||MEDIUM

EPSS-0.73% / 72.69%

7 Day CHG~0.00%

Published-13 Jun, 2024 | 09:04

Updated-17 Sep, 2024 | 11:08

Adobe Commerce | Improper Access Control (CWE-284)

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-magento commerce_webhooks commerce Adobe Commerce commerce

CWE ID-CWE-284

Improper Access Control

CVE-2024-26029

Matching Score-10

Matching Score-10

CVSS Score-7.5||HIGH

EPSS-0.13% / 32.17%

7 Day CHG~0.00%

Published-13 Jun, 2024 | 07:53

Updated-07 Oct, 2024 | 13:21

Adobe Experience Manager | Improper Access Control (CWE-284)

Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain disclose information. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-284

Improper Access Control

CVE-2019-8016

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-7.29% / 91.68%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:42

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8071

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-0.65% / 70.85%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 18:03

Updated-04 Aug, 2024 | 21:10

Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.

Vendor-Microsoft Corporation Adobe Inc.

Product-windows download_manager Adobe Download Manager

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2019-8045

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-42.50% / 97.47%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:58

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-8074

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-7.73% / 91.95%

7 Day CHG~0.00%

Published-27 Sep, 2019 | 15:20

Updated-04 Aug, 2024 | 21:10

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability. Successful exploitation could lead to Access Control Bypass in the context of the current user.

Vendor-Adobe Inc.

Product-coldfusion Cold Fusion

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2019-8237

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-1.01% / 77.13%

7 Day CHG~0.00%

Published-23 Oct, 2019 | 20:46

Updated-04 Aug, 2024 | 21:17

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an insufficiently robust encryption vulnerability. Successful exploitation could lead to security feature bypass.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CVE-2019-8047

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-30.10% / 96.68%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:58

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8044

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-37.21% / 97.18%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:57

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a double free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-415

Double Free

CVE-2019-8017

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-35.34% / 97.06%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:43

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-8050

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-31.40% / 96.79%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:00

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8073

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-12.78% / 94.03%

7 Day CHG~0.00%

Published-27 Sep, 2019 | 15:19

Updated-04 Aug, 2024 | 21:10

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the context of the current user.

Vendor-Adobe Inc.

Product-coldfusion Cold Fusion

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2019-8211

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-5.27% / 90.01%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:25

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8088

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-10.92% / 93.42%

7 Day CHG~0.00%

Published-25 Oct, 2019 | 15:21

Updated-04 Aug, 2024 | 21:10

Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2019-8161

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.18% / 86.97%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:11

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2019-8196

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-29.78% / 96.64%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:22

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-8028

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-30.10% / 96.68%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:51

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8003

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-30.10% / 96.68%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:33

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2008-0655

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-68.77% / 98.63%

7 Day CHG~0.00%

Published-07 Feb, 2008 | 20:00

Updated-12 Nov, 2025 | 15:15

Known KEV||Action Due Date - 2022-06-22||Apply updates per vendor instructions.

Multiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors.

Vendor-n/a Adobe Inc.

Product-acrobat_reader acrobat n/a Acrobat and Reader

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2023-4661

Matching Score-8

Assigner-TR-CERT (Computer Emergency Response Team of the Republic of Türkiye)

Matching Score-8

Assigner-TR-CERT (Computer Emergency Response Team of the Republic of Türkiye)

CVSS Score-9.8||CRITICAL

EPSS-0.19% / 40.85%

7 Day CHG~0.00%

Published-15 Sep, 2023 | 08:34

Updated-24 Sep, 2025 | 19:37

SQLi in Saphira Connect

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Connect allows SQL Injection.This issue affects Saphira Connect: before 9.

Vendor-Saphira Adobe Inc.

Product-connect Saphira Connect

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2025-24447

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-28.36% / 96.52%

7 Day CHG~0.00%

Published-08 Apr, 2025 | 20:02

Updated-22 Apr, 2025 | 22:15

ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-coldfusion ColdFusion

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2016-7886

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-10.46% / 93.25%

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe InDesign version 11.4.1 and earlier, Adobe InDesign Server 11.0.0 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-indesign_server windows macos indesign Adobe InDesign 11.4.1 and earlier, InDesign Server 11.0.0 and earlier

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2023-4662

Matching Score-8

Assigner-TR-CERT (Computer Emergency Response Team of the Republic of Türkiye)

Matching Score-8

Assigner-TR-CERT (Computer Emergency Response Team of the Republic of Türkiye)

CVSS Score-9.8||CRITICAL

EPSS-0.74% / 72.94%

7 Day CHG~0.00%

Published-15 Sep, 2023 | 08:36

Updated-24 Sep, 2025 | 19:37

RCE in Saphira Connect

Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion.This issue affects Saphira Connect: before 9.

Vendor-Saphira Adobe Inc.

Product-connect Saphira Connect

CWE ID-CWE-250

Execution with Unnecessary Privileges

CWE ID-CWE-269

Improper Privilege Management

CVE-2016-1019

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-72.38% / 98.76%

7 Day CHG+0.95%

Published-07 Apr, 2016 | 10:00

Updated-17 Nov, 2025 | 20:15

Known KEV||Action Due Date - 2022-03-24||The impacted product is end-of-life and should be disconnected if still in use.

Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

Product-iphone_os chrome_os air_sdk_\&_compiler air_desktop_runtime windows_10 windows flash_player_desktop_runtime air_sdk linux_kernel flash_player windows_8.1 android mac_os_x n/a Flash Player

CVE-2016-4160

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.16% / 86.93%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4120, CVE-2016-4161, CVE-2016-4162, and CVE-2016-4163.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-4162

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.16% / 86.93%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-4117

Matching Score-8

Matching Score-8

Product-enterprise_linux_server_from_rhui enterprise_linux_server enterprise_linux_desktop evergreen linux_enterprise_desktop enterprise_linux_workstation flash_player opensuse linux_enterprise_workstation_extension n/a Flash Player

CVSS Score-7.8||HIGH

EPSS-93.12% / 99.80%

7 Day CHG+0.04%

Published-11 May, 2016 | 01:00

Updated-17 Nov, 2025 | 20:15

Known KEV||Action Due Date - 2022-03-24||The impacted product is end-of-life and should be disconnected if still in use.

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

Vendor-n/a Adobe Inc.openSUSE Red Hat, Inc.SUSE

CVE-2016-4161

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.16% / 86.93%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-19594

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-5.56% / 90.29%

7 Day CHG~0.00%

Published-05 Dec, 2019 | 15:26

Updated-05 Aug, 2024 | 02:16

reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a .php file.

Vendor-n/a Adobe Inc.PrestaShop S.A

Product-stock_api_integration prestashop n/a

CWE ID-CWE-434

Unrestricted Upload of File with Dangerous Type

CVE-2019-19595

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-5.56% / 90.29%

7 Day CHG~0.00%

Published-05 Dec, 2019 | 15:25

Updated-05 Aug, 2024 | 02:16

reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file.

Vendor-n/a Adobe Inc.PrestaShop S.A

Product-stock_api_integration prestashop n/a

CWE ID-CWE-434

Unrestricted Upload of File with Dangerous Type

CVE-2016-4171

Matching Score-8

Matching Score-8

Vendor-n/a Apple Inc.Adobe Inc.openSUSE Microsoft Corporation Google LLC Linux Kernel Organization, Inc Red Hat, Inc.SUSE

CVSS Score-7.8||HIGH

EPSS-56.45% / 98.13%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-17 Nov, 2025 | 20:15

Known KEV||Action Due Date - 2022-04-15||The impacted product is end-of-life and should be disconnected if still in use.

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

Product-macos enterprise_linux_server chrome_os enterprise_linux_desktop windows_10 windows linux_enterprise_desktop linux_kernel flash_player windows_8.1 enterprise_linux_workstation opensuse linux_enterprise_workstation_extension mac_os_x n/a Flash Player

CVE-2016-4120

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.16% / 86.93%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4160, CVE-2016-4161, CVE-2016-4162, and CVE-2016-4163.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-4163

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.16% / 86.93%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-4121

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-5.23% / 89.97%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, and CVE-2016-4110.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

CVE-2019-16454

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.56% / 85.54%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:50

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-16450

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.56% / 85.54%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:43

Updated-05 Aug, 2024 | 01:17

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-16462

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.60% / 87.78%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:58

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CVE-2019-16445

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.79% / 89.50%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:31

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-16460

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.60% / 85.64%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:57

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-16444

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-1.24% / 79.25%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:29

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a binary planting (default folder privilege escalation) vulnerability. Successful exploitation could lead to privilege escalation.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CVE-2019-16446

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.60% / 85.64%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:33

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-16455

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.60% / 85.64%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:51

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-16451

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-23.29% / 95.97%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:45

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc macos windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-1114

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.34% / 84.89%

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2019-16464

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.79% / 89.50%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 15:01

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2020-9580

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-6.22% / 90.90%

7 Day CHG~0.00%

Published-26 Jun, 2020 | 20:19

Updated-04 Aug, 2024 | 10:34

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-magento Adobe Inc.

Product-magento Magento

CVE-2019-16452

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-5.66% / 90.39%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:46

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-16448

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.79% / 89.50%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:37

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc macos windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-16453

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.49% / 85.33%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:47

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CVE-2019-16459

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.79% / 89.50%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:56

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .