ByteOS

Product:ColdFusion

Added At:15 Mar, 2023

Due At:05 Apr, 2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.

Used in Ransomware

Unknown

CWE

CWE-284

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html; https://nvd.nist.gov/vuln/detail/CVE-2023-26360

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:23 Mar, 2023 | 00:00

Updated At:30 Jul, 2025 | 01:37

▼CVE Numbering Authority (CNA)

Adobe ColdFusion Improper Access Control Arbitrary code execution

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Affected Products

Vendor

Product

ColdFusion

Versions

Affected

From unspecified through CF2018U15 (custom)
From unspecified through CF2021U5 (custom)
From unspecified through None (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-284	Improper Access Control (CWE-284)

Type: CWE

CWE ID: CWE-284

Description: Improper Access Control (CWE-284)

Metrics

Version	Base score	Base severity	Vector
3.1	8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Version: 3.1

Base score: 8.6

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html	N/A
http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html	N/A

Hyperlink: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html

Resource: N/A

Hyperlink: http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html	x_transferred
http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html	x_transferred

Hyperlink: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html

Resource:

x_transferred

Hyperlink: http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

kev

dateAdded:

2023-03-15

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26360

Timeline

Event	Date
CVE-2023-26360 added to CISA KEV	2023-03-15 00:00:00

Event: CVE-2023-26360 added to CISA KEV

Date: 2023-03-15 00:00:00

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:psirt@adobe.com

Published At:23 Mar, 2023 | 20:15

Updated At:13 Feb, 2025 | 17:30

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2023-03-15	2023-04-05	Adobe ColdFusion Deserialization of Untrusted Data Vulnerability	Apply updates per vendor instructions.

Date Added: 2023-03-15

Due Date: 2023-04-05

Vulnerability Name: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 8.6

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE Matches

cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*

>>coldfusion>>2018

cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*

>>coldfusion>>2021

cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*

>>coldfusion>>2021

cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*

>>coldfusion>>2021

cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*

>>coldfusion>>2021

cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*

>>coldfusion>>2021

cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*

>>coldfusion>>2021

Weaknesses

CWE ID	Type	Source
CWE-284	Secondary	psirt@adobe.com
NVD-CWE-Other	Primary	nvd@nist.gov

CWE ID: CWE-284

Type: Secondary

Source: psirt@adobe.com

CWE ID: NVD-CWE-Other

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html	psirt@adobe.com	Exploit Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html	psirt@adobe.com	Patch Vendor Advisory
http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory

Hyperlink: http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html

Source: psirt@adobe.com

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html

Source: psirt@adobe.com

Resource:

Patch

Vendor Advisory

Hyperlink: http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Similar CVEs

628Records found

CVE-2019-7131

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-12.57% / 93.70%

7 Day CHG~0.00%

Published-27 Jan, 2020 | 23:12

Updated-04 Aug, 2024 | 20:38

Adobe Acrobat and Reader versions 2019.010.20064 and earlier, 2019.010.20064 and earlier, 2017.011.30110 and earlier version, and 2015.006.30461 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2019-8041

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-39.72% / 97.21%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:56

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8026

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-30.10% / 96.51%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:50

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8205

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.12% / 88.18%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:24

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-8161

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.18% / 86.45%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:11

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2024-41874

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-29.04% / 96.41%

7 Day CHG~0.00%

Published-13 Sep, 2024 | 09:18

Updated-16 Sep, 2024 | 12:56

ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing crafted input to the application, which when deserialized, leads to execution of malicious code. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-coldfusion ColdFusion coldfusion

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2014-0497

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-93.02% / 99.77%

7 Day CHG~0.00%

Published-05 Feb, 2014 | 02:00

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2024-10-08||The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

CWE ID-CWE-191

Integer Underflow (Wrap or Wraparound)

CVE-2024-45115

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-0.34% / 56.17%

7 Day CHG~0.00%

Published-10 Oct, 2024 | 09:58

Updated-10 Oct, 2024 | 21:51

Adobe Commerce | Improper Authentication (CWE-287)

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-magento commerce commerce_b2b Adobe Commerce commerce

CWE ID-CWE-287

Improper Authentication

CVE-2020-9578

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.23% / 86.58%

7 Day CHG~0.00%

Published-26 Jun, 2020 | 20:20

Updated-04 Aug, 2024 | 10:34

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-magento Adobe Inc.

Product-magento Magento

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2020-9579

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-6.22% / 90.51%

7 Day CHG~0.00%

Published-26 Jun, 2020 | 20:18

Updated-04 Aug, 2024 | 10:34

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-magento Adobe Inc.

Product-magento Magento

CVE-2017-11308

Matching Score-8

Matching Score-8

Product-acrobat_dc acrobat_reader acrobat acrobat_reader_dc windows macos Adobe Acrobat and Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions

CVSS Score-9.8||CRITICAL

EPSS-22.41% / 95.62%

7 Day CHG~0.00%

Published-19 May, 2018 | 17:00

Updated-05 Aug, 2024 | 18:05

Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-3792

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-25.38% / 96.00%

7 Day CHG~0.00%

Published-25 Mar, 2020 | 15:56

Updated-04 Aug, 2024 | 07:44

Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and earlier have a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2017-11284

Matching Score-8

Matching Score-8

Product-coldfusion Adobe ColdFusion Update 4 and earlier versions for ColdFusion 2016 release. Update 12 and earlier versions for ColdFusion 11.

CVSS Score-9.8||CRITICAL

EPSS-23.86% / 95.80%

7 Day CHG~0.00%

Published-01 Dec, 2017 | 08:00

Updated-20 Apr, 2025 | 01:37

Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

Vendor-n/a Adobe Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-3765

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.56% / 84.95%

7 Day CHG~0.00%

Published-20 Feb, 2020 | 20:35

Updated-05 May, 2025 | 17:16

Adobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Microsoft Corporation Adobe Inc.

Product-after_effects windows Adobe After Effects

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-3784

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-10.06% / 92.79%

7 Day CHG~0.00%

Published-25 Mar, 2020 | 20:31

Updated-04 Aug, 2024 | 07:44

Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.

Product-photoshop_2020 windows photoshop_cc macos Adobe Photoshop

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-3749

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.38% / 88.55%

7 Day CHG~0.00%

Published-13 Feb, 2020 | 15:45

Updated-04 Aug, 2024 | 07:44

Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2020-3788

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-10.06% / 92.79%

7 Day CHG~0.00%

Published-25 Mar, 2020 | 20:35

Updated-04 Aug, 2024 | 07:44

Product-photoshop_2020 windows photoshop_cc macos Adobe Photoshop

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-3743

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.38% / 88.55%

7 Day CHG~0.00%

Published-13 Feb, 2020 | 15:44

Updated-04 Aug, 2024 | 07:44

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2024-34112

Matching Score-6

Matching Score-6

CVSS Score-7.5||HIGH

EPSS-5.08% / 89.39%

7 Day CHG~0.00%

Published-13 Jun, 2024 | 11:27

Updated-03 Dec, 2024 | 14:35

ColdFusion CFDOCUMENT file retrieval / access control bypass

ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could exploit this vulnerability to gain unauthorized access to sensitive files or data. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-coldfusion ColdFusion coldfusion

CWE ID-CWE-284

Improper Access Control

CVE-2023-22250

Matching Score-6

Matching Score-6

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 12.64%

7 Day CHG~0.00%

Published-27 Mar, 2023 | 00:00

Updated-05 Mar, 2025 | 19:21

Adobe Commerce Improper Access Control Security feature bypass

Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-magento_open_source commerce Magento Commerce

CWE ID-CWE-284

Improper Access Control

CVE-2023-22232

Matching Score-6

Matching Score-6

CVSS Score-5.3||MEDIUM

EPSS-88.66% / 99.48%

7 Day CHG~0.00%

Published-17 Feb, 2023 | 00:00

Updated-05 Mar, 2025 | 19:26

Adobe Connect Improper Access Control Security feature bypass

Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-connect Connect

CWE ID-CWE-284

Improper Access Control

CVE-2021-28579

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 54.36%

7 Day CHG~0.00%

Published-28 Jun, 2021 | 14:13

Updated-23 Apr, 2025 | 19:40

Adobe Connect improper access control could lead to privilege escalation

Adobe Connect version 11.2.1 (and earlier) is affected by an Improper access control vulnerability that can lead to the elevation of privileges. An attacker with 'Learner' permissions can leverage this scenario to access the list of event participants.

Vendor-Adobe Inc.

Product-connect Connect

CWE ID-CWE-284

Improper Access Control

CVE-2024-20767

Matching Score-6

Matching Score-6

CVSS Score-7.4||HIGH

EPSS-94.13% / 99.90%

7 Day CHG~0.00%

Published-18 Mar, 2024 | 11:43

Updated-30 Jul, 2025 | 01:37

Known KEV||Action Due Date - 2025-01-06||Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ColdFusion | Improper Access Control (CWE-284)

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.

Vendor-Adobe Inc.

Product-coldfusion ColdFusion coldfusion ColdFusion

CWE ID-CWE-284

Improper Access Control

CVE-2021-21083

Matching Score-6

Matching Score-6

CVSS Score-7.5||HIGH

EPSS-0.55% / 66.85%

7 Day CHG~0.00%

Published-28 Jun, 2021 | 13:41

Updated-16 Sep, 2024 | 16:23

Adobe Experience Manager broken access control in DSRPReindexServlet could lead to denial-of-service

AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the current user.

Vendor-Adobe Inc.

Product-experience_manager_cloud_service experience_manager Experience Manager

CWE ID-CWE-284

Improper Access Control

CVE-2021-21020

Matching Score-6

Matching Score-6

CVSS Score-5.3||MEDIUM

EPSS-0.19% / 41.04%

7 Day CHG~0.00%

Published-11 Feb, 2021 | 19:29

Updated-16 Sep, 2024 | 23:37

Magento Commerce Improper Access Control Vulnerability

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources.

Vendor-magento Adobe Inc.

Product-magento Magento Commerce

CWE ID-CWE-284

Improper Access Control

CVE-2016-1117

Matching Score-6

Matching Score-6

CVSS Score-9.8||CRITICAL

EPSS-9.02% / 92.29%

7 Day CHG~0.00%

Published-11 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1039, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1044, and CVE-2016-1062.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_dc reader windows acrobat mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2021-21045

Matching Score-6

Matching Score-6

CVSS Score-8.2||HIGH

EPSS-1.02% / 76.31%

7 Day CHG~0.00%

Published-11 Feb, 2021 | 19:42

Updated-16 Sep, 2024 | 21:07

Acrobat Reader DC Improper Installer Access Control Vulnerability Could Lead To Privilege Escalation

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an improper access control vulnerability. An unauthenticated attacker could leverage this vulnerability to elevate privileges in the context of the current user.

Product-acrobat_dc acrobat_reader acrobat acrobat_reader_dc windows macos Acrobat Reader acrobat_reader_2017 acrobat_dc acrobat_2020 acrobat_2017 acrobat_reader_dc acrobat_reader_2020

CWE ID-CWE-284

Improper Access Control

CVE-2016-1041

Matching Score-6

Matching Score-6

CVSS Score-10||CRITICAL

EPSS-8.67% / 92.11%

7 Day CHG~0.00%

Published-11 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1039, CVE-2016-1040, CVE-2016-1042, CVE-2016-1044, CVE-2016-1062, and CVE-2016-1117.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_dc reader windows acrobat mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2016-1042

Matching Score-6

Matching Score-6

CVSS Score-9.8||CRITICAL

EPSS-8.67% / 92.11%

7 Day CHG~0.00%

Published-11 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_dc reader windows acrobat mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2016-1062

Matching Score-6

Matching Score-6

CVSS Score-9.8||CRITICAL

EPSS-9.02% / 92.29%

7 Day CHG~0.00%

Published-11 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_dc reader windows acrobat mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2016-1038

Matching Score-6

Matching Score-6

CVSS Score-10||CRITICAL

EPSS-5.58% / 89.94%

7 Day CHG~0.00%

Published-11 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1039, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1044, CVE-2016-1062, and CVE-2016-1117.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_dc reader windows acrobat mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2016-1040

Matching Score-6

Matching Score-6

CVSS Score-9.8||CRITICAL

EPSS-8.28% / 91.91%

7 Day CHG~0.00%

Published-11 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1039, CVE-2016-1041, CVE-2016-1042, CVE-2016-1044, CVE-2016-1062, and CVE-2016-1117.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_dc reader windows acrobat mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2016-1039

Matching Score-6

Matching Score-6

CVSS Score-9.8||CRITICAL

EPSS-8.67% / 92.11%

7 Day CHG~0.00%

Published-11 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1044, CVE-2016-1062, and CVE-2016-1117.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_dc reader windows acrobat mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2016-1044

Matching Score-6

Matching Score-6

CVSS Score-10||CRITICAL

EPSS-6.12% / 90.43%

7 Day CHG~0.00%

Published-11 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_dc reader windows acrobat mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2025-43586

Matching Score-6

Matching Score-6

CVSS Score-8.1||HIGH

EPSS-0.08% / 23.80%

7 Day CHG~0.00%

Published-10 Jun, 2025 | 16:08

Updated-23 Jun, 2025 | 19:22

Adobe Commerce | Improper Access Control (CWE-284)

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized elevated access. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-commerce_b2b commerce magento Adobe Commerce

CWE ID-CWE-284

Improper Access Control

CVE-2025-43563

Matching Score-6

Matching Score-6

CVSS Score-9.1||CRITICAL

EPSS-0.09% / 27.22%

7 Day CHG~0.00%

Published-13 May, 2025 | 20:49

Updated-15 Jul, 2025 | 18:40

ColdFusion | Improper Access Control (CWE-284)

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed.

Vendor-Adobe Inc.

Product-coldfusion ColdFusion

CWE ID-CWE-284

Improper Access Control

CVE-2020-24441

Matching Score-6

Matching Score-6

CVSS Score-5.5||MEDIUM

EPSS-0.79% / 72.91%

7 Day CHG~0.00%

Published-12 Nov, 2020 | 14:34

Updated-16 Sep, 2024 | 20:37

Improper Access Control in Adobe Acrobat Reader for Android

Adobe Acrobat Reader for Android version 20.6.2 (and earlier) does not properly restrict access to directories created by the application. This could result in disclosure of sensitive information stored in databases used by the application. Exploitation requires a victim to download and run a malicious application.

Vendor-Adobe Inc.

Product-acrobat_reader Acrobat Reader

CWE ID-CWE-284

Improper Access Control

CVE-2015-5116

Matching Score-6

Matching Score-6

CVSS Score-5||MEDIUM

EPSS-27.66% / 96.26%

7 Day CHG~0.00%

Published-09 Jul, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, and CVE-2015-3125.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2020-24433

Matching Score-6

Matching Score-6

CVSS Score-7.8||HIGH

EPSS-1.62% / 81.08%

7 Day CHG~0.00%

Published-05 Nov, 2020 | 19:32

Updated-16 Sep, 2024 | 21:57

Adobe Acrobat Reader DC Local Privilege Escalation via Installer Component

Adobe Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a local privilege escalation vulnerability that could enable a user without administrator privileges to delete arbitrary files and potentially execute arbitrary code as SYSTEM. Exploitation of this issue requires an attacker to socially engineer a victim, or the attacker must already have some access to the environment.

Product-acrobat_dc acrobat_reader acrobat acrobat_reader_dc windows macos Acrobat Reader

CWE ID-CWE-284

Improper Access Control

CVE-2015-3125

Matching Score-6

Matching Score-6

CVSS Score-5||MEDIUM

EPSS-0.35% / 56.89%

7 Day CHG~0.00%

Published-09 Jul, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2015-3063

Matching Score-6

Matching Score-6

CVSS Score-10||HIGH

EPSS-3.03% / 86.13%

7 Day CHG~0.00%

Published-13 May, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-284

Improper Access Control

CVE-2015-3074

Matching Score-6

Matching Score-6

CVSS Score-10||HIGH

EPSS-3.03% / 86.13%

7 Day CHG~0.00%

Published-13 May, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, and CVE-2015-3073.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-284

Improper Access Control

CVE-2015-3061

Matching Score-6

Matching Score-6

CVSS Score-10||HIGH

EPSS-3.03% / 86.13%

7 Day CHG~0.00%

Published-13 May, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-284

Improper Access Control

CVE-2015-3062

Matching Score-6

Matching Score-6

CVSS Score-10||HIGH

EPSS-3.03% / 86.13%

7 Day CHG~0.00%

Published-13 May, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-284

Improper Access Control

CVE-2015-3114

Matching Score-6

Matching Score-6

CVSS Score-5||MEDIUM

EPSS-0.43% / 61.41%

7 Day CHG~0.00%

Published-09 Jul, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2015-3064

Matching Score-6

Matching Score-6

CVSS Score-10||HIGH

EPSS-3.03% / 86.13%

7 Day CHG~0.00%

Published-13 May, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-284

Improper Access Control

CVE-2015-3115

Matching Score-6

Matching Score-6

CVSS Score-5||MEDIUM

EPSS-0.24% / 46.25%

7 Day CHG~0.00%

Published-09 Jul, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2015-3065

Matching Score-6

Matching Score-6

CVSS Score-10||HIGH

EPSS-3.03% / 86.13%

7 Day CHG~0.00%

Published-13 May, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-284

Improper Access Control

CVE-2015-3060

Matching Score-6

Matching Score-6

CVSS Score-10||HIGH

EPSS-3.03% / 86.13%

7 Day CHG~0.00%

Published-13 May, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-284

Improper Access Control

CVE-2015-3072

Matching Score-6

Matching Score-6