Coldfusion vulnerabilitiesAnd the versions its exploited flaws hit.
Coldfusion is made by Adobe. We track 177 published vulnerabilities listed under that exact name, across 24 versions. 17 of them are on the list of flaws known to be exploited, the newest added on 7 July 2026. Adobe lists newer releases under their own names, such as Coldfusion Builder, so check those pages too.
The most recent Coldfusion flaw added to the known-exploited list is CVE-2026-48282, on 7 July 2026. We keep watching the known-exploited list.
Is Coldfusion listed under other names? Yes.
Adobe also lists Coldfusion under more specific names, such as Coldfusion Builder. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which versions of Coldfusion do the exploited flaws hit?
Each exploited flaw lists the versions it affects, as published by the vendor. Find your version, then patch.
- CVE-2026-48282Exploited list, 7 Jul 2026
Adobe ColdFusion Path Traversal Vulnerability
20232023-update12023-update22023-update32023-update42023-update52023-update62023-update7 - CVE-2017-3066Exploited list, 24 Feb 2025
Adobe ColdFusion Deserialization Vulnerability
10.010.0-update110.0-update210.0-update310.0-update410.0-update510.0-update610.0-update7 - CVE-2024-20767Exploited list, 16 Dec 2024
Adobe ColdFusion Improper Access Control Vulnerability
20212021-update12021-update22021-update32021-update42021-update52021-update62021-update7 - CVE-2023-29300Exploited list, 8 Jan 2024
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
20182018-update12018-update22018-update32018-update42018-update52018-update62018-update7 - CVE-2023-38203Exploited list, 8 Jan 2024
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
20182018-update12018-update22018-update32018-update42018-update52018-update62018-update7 - CVE-2023-26359Exploited list, 21 Aug 2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
20182018-update12018-update22018-update32018-update42018-update52018-update62018-update7 - CVE-2023-29298Exploited list, 20 Jul 2023
Adobe ColdFusion Improper Access Control Vulnerability
20182018-update12018-update22018-update32018-update42018-update52018-update62018-update7 - CVE-2023-38205Exploited list, 20 Jul 2023
Adobe ColdFusion Improper Access Control Vulnerability
20182018-update12018-update22018-update32018-update42018-update52018-update62018-update7 - CVE-2023-26360Exploited list, 15 Mar 2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
20182018-update12018-update22018-update32018-update42018-update52018-update62018-update7 - CVE-2010-2861Exploited list, 25 Mar 2022
Adobe ColdFusion Directory Traversal Vulnerability
up to 9.0.1 - CVE-2009-3960Exploited list, 7 Mar 2022
Adobe BlazeDS Information Disclosure Vulnerability
7.0.28.08.0.19.0 - CVE-2013-0625Exploited list, 7 Mar 2022
Adobe ColdFusion Authentication Bypass Vulnerability
9.09.0.19.0.2 - CVE-2013-0629Exploited list, 7 Mar 2022
Adobe ColdFusion Directory Traversal Vulnerability
9.09.0.19.0.210.0 - CVE-2013-0631Exploited list, 7 Mar 2022
Adobe ColdFusion Information Disclosure Vulnerability
9.09.0.19.0.2 - CVE-2013-0632Exploited list, 3 Mar 2022
Adobe ColdFusion Authentication Bypass Vulnerability
9.09.0.19.0.210.0 - CVE-2018-4939Exploited list, 3 Nov 2021
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
11.011.0-update111.0-update211.0-update311.0-update411.0-update511.0-update611.0-update7 - CVE-2018-15961Exploited list, 3 Nov 2021
Adobe ColdFusion Unrestricted File Upload Vulnerability
11.011.0-update111.0-update211.0-update311.0-update411.0-update511.0-update611.0-update7
Which Coldfusion vulnerabilities are being exploited?
17 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 10.0Adobe ColdFusion Path Traversal Vulnerability
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
- 9.8Adobe ColdFusion Deserialization Vulnerability
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
- 7.4Adobe ColdFusion Improper Access Control Vulnerability
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
- 9.8Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
- 9.8Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
- 9.8Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.
- 7.5Adobe ColdFusion Improper Access Control Vulnerability
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
- 7.5Adobe ColdFusion Improper Access Control Vulnerability
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Which Coldfusion flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution.
- >99%
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability.
- >99%
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass.
- >99%
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass.
- >99%
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1)...
- 99%
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read.
- 97%
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the...
- 97%
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution.
- 94%
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in...
- 94%
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password...
Running Coldfusion? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
- Matched to
- Coldfusion on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 177 published vulnerabilities listed under the name Coldfusion, across 24 versions. The most recent Coldfusion flaw added to the known-exploited list is CVE-2026-48282, on 7 July 2026.
17 are on the list of flaws known to be exploited. The most recently added are CVE-2026-48282, CVE-2017-3066 and CVE-2024-20767.
Adobe also lists Coldfusion under more specific names, such as Coldfusion Builder. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Each flaw names its own versions, usually as ranges. The newest, CVE-2026-48282, affects 2023, 2023-update1, 2023-update2, 2023-update3 and more. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Coldfusion. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.