CVE-2023-26360

CVE-2023-26360 is a critical vulnerability found in Adobe ColdFusion, an application development platform. The flaw is characterized as an improper access control issue and can lead to arbitrary code execution when exploited. This vulnerability was publicly disclosed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) via an advisory notice, warning that threat actors were actively exploiting it. In June and July of 2023, unknown attackers leveraged this vulnerability to gain unauthorized access to government servers. CISA confirmed that an unnamed federal agency was compromised during this period due to the exploitation of CVE-2023-26360. The breach was facilitated by the flaw's ability to allow arbitrary code execution, leading to a significant security incident within the targeted agency. In response to the active threat, CISA issued an alert in December 2023 urging organizations to take immediate action against this vulnerability. The agency stressed the severity of the situation, highlighting that the flaw had been used to breach government agencies. Adobe has not yet released a patch or workaround for the flaw at the time of the alert, making the vulnerability a significant risk to any organization using the affected version of Adobe ColdFusion.