On the penultimate project, I got ColdFusion 2021 for nginx return proxy - the internal portal of personnel accounting of the bank, which was "forgotten" when migrating to a new stack. Three hours from /CFIDE/administrator/ in nmap-remote to loading CFML-webshell. The server has not been updated for more than a year, and during this time Adobe has closed more than a dozen holes with CVSS 10.0. And no, it’s not legacy-hums of zero – these are the working servers of financial institutions and enterprise-companies where ColdFusion pulls critical business processes.
Business logic: why break ColdFusion
ColdFusion spins on JVM and usually works with the privileges of a service account that has access to the file system, databases and internal network. Compromise of the ColdFusion server gives the attacker:
• Arbitrary file read - configuration files with database data, API keys, LDAP-passwords. By MITRE ATT&CK is Credentials In Files (T1552.001, Credential Access)
• Webshell deployment - persistent access through CFML files that do not cause suspicion in standard antivirus engines. This is Web Shell (T1505.003, Persistence)
• Lateral movement - through stolen credentials or direct networking with internal services
According to SecPod (December 2025), in the Christmas campaign of 2025 recorded the actor who generated thousands of malicious requests for a set of ColdFusion CVE. The main activity occurred on December 25 - the calculation for weakened monitoring during the holidays. ColdFusion-exploitation accounted for a small fraction of a larger campaign, which may indicate different monetization models, although specific attribution (IAB - Initial Access Broker, etc.) sources are not confirmed.
According to OWASP, the ColdFusion vulnerabilities in A01 (Broken Access Control) and A08 (Software and Data Integry Failures) - two of the three most frequent categories in enterprise-applications.
Fingerprinting ColdFusion in the perimeter
ColdFusion leaves the characteristic traces that are visible before sending requests to the target.
Shodan requests for passive recon:
Code:
http.title:"ColdFusion Administrator"
http.favicon.hash:-1315857455
http.html:"/CFIDE/"
Key markers in HTTP responses: cookies CFID and CFTOKEN (specific for ColdFusion), paths /CFIDE/administrator/, /CFIDE/adminapi/, /CFIDE/scripts/, extensions .cfm and .cfc in the URL. Title Server: ColdFusion It also comes out if it was not removed with hardening.
To determine the exact version - request to /CFIDE/adminapi/base.cfc?wsdl returns the WSDL description, where in namespace can stick out the version number. Page /CFIDE/administrator/index.cfm shows the form of the administrator login, if the endpoint is not closed.
Disorders of fingerprinting: The return proxy (nginx, Apache) before ColdFusion is able to hide the characteristic headlines and paths. In this case, look for indirect features - Java-stacks in the answers 500, specific form action in HTML, the presence of WDDX structures in the body of answers.
Map CVE: from path traversal to desyringization
All three CISA KEV CVE sits in Top 5% on EPSS. These are not theoretical threats – these are actively exploited vectors.
According to the analysis of the researchers, the problem is supposedly related to the processing of file operations (a specific vulnerable component is not specified in NV advisory). Custom input is processed without canonicalization of the path, without checking the exit beyond the root directory and without sequence filtering ../ (CWE-22, Path Traversal)
CVSS-vector: CVSS:3.1/AV:N/AV:N/A:N/A:H/A:H/A:H/A:H/AH. Decryption: an attack over the network (AV:N), low complexity (AC:L), authentication is not needed (PR:N), the user's actions are not needed (UI:N), changed scopeS:C - the impact goes beyond the vulnerable component. Full impact on privacy, integrity and accessibility.
The result is coded execution (according to NVD). The proposed operation vector based on the patch analysis: path traversal is used as file write primitive, after which the CFML file in the web root gives an unauthenticated RCE with the rights of the ColdFusion service account.
Timeline of weapons:
• June 30, 2026 - Adobe releases patch (APSB26-68), closing 11 vulnerabilities, six of them with CVSS 10.0
• July 2, 2026 - Researchers publish a patch analysis (patch diff)
• Less than 2 hours later - according to available data, the first attempts of operation were recorded (specific IoC require a source check)
• July 7, 2026 - CISA adds CVE to KEV Catalog with "Act" (Exposition: active, Automable: yes, technical impact: total)
Two hours. From the publication of pap diff to the first attacks - two hours. If you were planning to put a patch next week, it’s too late.
Affected versions: ColdFusion 2025 Update 9 and earlier, ColdFusion 2023 Update 20 and earlier.
Predictions: the exact vulnerable component is not specified in NVD; the advisory is supposedly related to RDS (DSServlet), but this is not officially confirmed. Does not work if: used patch APSB26-68, WAF with custom rules inspects non-standard protocols. There is a nuance: standard WAF does not disassemble the body of binary RDS-queries - path traversal-signature (../, ..%2f) work only at the URL level.
In the same update APSB26-68 is closed CVE-2026-48276 and CVE-2026-48283 (both CWE-434, Unrestricted Upload of File with Dangerous Type, CVSS 10.0) CVE-2026-48277, CVE-2026-48281 and CVE-2026-48316 (All CWE-20, Improper Input Validation, CVSS 10.0). Six vulnerabilities with maximum rating in one update - such a critical-bug density for one product I do not remember.
EPSS 0.9851 - Top 1%, one of the most actively exploited ColdFusion Vulnerabilities.
Predictions (critical): admin panel should be available via the Internet. The NVD utters: "Exploration of this issue to require the admin panel be exposed to the internet.""To exploit this vulnerability, it is necessary that the administrative panel is available from the Internet." From here, AC:H (high complexity) in the CVSS vector is not because the exploit is complex, but because a specific condition of the environment is needed. For the same reason AC:H has been appropriated and CVE-2024-53961 - both require admin panel accessibility.
Most of the attackers used DigitalOcean Droplets, which were quickly blocked by the hoster.
What can be achieved with successful operation:
• neo-security.xml- hash passwords of ColdFusion administrator
• neo-datasource.xml- DB connection lines, including passwords
• password.properties- exed to decipher Data Source passwords
• web.xml- servlet configuration, useful for planning the next step
Affected versions: ColdFusion 2023 Update 6 and earlier, ColdFusion 2021 Update 12 and before.
CVE-2024-53961 (CVSS 8.1, High, CWE-22) - a similar story: path traversal. The NVD description indicates a file system system adhappy read, but CVSS vector (C:H/H/H/H/:H) involves the impact and integrity and availability - the discrepancy between the description and the vector should be clarified with NVD/Adobe. It also requires admin panel availability. According to unconfirmed reports, the PoC code for it could be available, which made patching a priority. EPSS 0.1340 (Top 5%).
CISA KEV describes it as "Deserialization of Untrusted Data Vulnerability" - there is a divergence of classifications: the NVD vector indicates only the impact on privacy (I:N/A:N), while CISA and NVD refer to the automatic code execution. CISA KEV since March 2023. According to inthewild.io, active operation lasts more than 1220 days.
Severity - High (CVSS 8.6), not Critical. CVSS vector:3.1/AV:N/C:C/C/N/A:N/A:N/A:N/N
N):N/N) indicates the effect only of privacy (I:N, A:N), which contradicts the wording of code execution in the NVD extreme description. Authentication is not required.
Affected versions: ColdFusion 2018 Update 15 and earlier, ColdFusion 2021 Update 5 and earlier. Nuclei-stwelrd: http/cves/2023/CVE-2023-26360.yaml.
The 2025 Christmas Campaign Includes Operation CVE-2023-26360 in conjunction with other CVE: attackers cyclically sorted the vectors with an interval of 1-5 seconds, using JNDI/LDAP injection, presumably pushed through WDDX degeneration. To confirm the vulnerability of hosts, OAS-collabs were used through Interactsh (ProjectDiscovery) - a legitimate tool for OOB verification, which makes it difficult to detect by network artifacts.
Operation Chain and Place in Killing Chaeh
A typical ColdFusion attack fits into this sequence of MITRE AT&CK:
1. Recon - Shodan/nuclei, detection /CFIDE/Endpoints, definition of version
2. Exploit Public-Facing Application (T1190, Initial Access) - the application of one of the CVE
3. Credentials In Files (T1552.001, Credential Access) )- Remove configuration files through file read
4. Web Shell (T1505.003, Persistence) - downloading CFML-webshell via file
5. Windows Command Shell (T1059.003, Execution) - execution of commands on behalf of the service account
6. Ingress Tool Transfer (T1105, C2) )- downloading tunneling tools or C2-agents
7. Exploitation for Privilege Escalation (T1068) )- if necessary, increase privileges
Business logic: why break ColdFusion
ColdFusion spins on JVM and usually works with the privileges of a service account that has access to the file system, databases and internal network. Compromise of the ColdFusion server gives the attacker:
• Arbitrary file read - configuration files with database data, API keys, LDAP-passwords. By MITRE ATT&CK is Credentials In Files (T1552.001, Credential Access)
• Webshell deployment - persistent access through CFML files that do not cause suspicion in standard antivirus engines. This is Web Shell (T1505.003, Persistence)
• Lateral movement - through stolen credentials or direct networking with internal services
According to SecPod (December 2025), in the Christmas campaign of 2025 recorded the actor who generated thousands of malicious requests for a set of ColdFusion CVE. The main activity occurred on December 25 - the calculation for weakened monitoring during the holidays. ColdFusion-exploitation accounted for a small fraction of a larger campaign, which may indicate different monetization models, although specific attribution (IAB - Initial Access Broker, etc.) sources are not confirmed.
According to OWASP, the ColdFusion vulnerabilities in A01 (Broken Access Control) and A08 (Software and Data Integry Failures) - two of the three most frequent categories in enterprise-applications.
Fingerprinting ColdFusion in the perimeter
ColdFusion leaves the characteristic traces that are visible before sending requests to the target.
Shodan requests for passive recon:
Code:
http.title:"ColdFusion Administrator"
http.favicon.hash:-1315857455
http.html:"/CFIDE/"
Key markers in HTTP responses: cookies CFID and CFTOKEN (specific for ColdFusion), paths /CFIDE/administrator/, /CFIDE/adminapi/, /CFIDE/scripts/, extensions .cfm and .cfc in the URL. Title Server: ColdFusion It also comes out if it was not removed with hardening.
To determine the exact version - request to /CFIDE/adminapi/base.cfc?wsdl returns the WSDL description, where in namespace can stick out the version number. Page /CFIDE/administrator/index.cfm shows the form of the administrator login, if the endpoint is not closed.
Disorders of fingerprinting: The return proxy (nginx, Apache) before ColdFusion is able to hide the characteristic headlines and paths. In this case, look for indirect features - Java-stacks in the answers 500, specific form action in HTML, the presence of WDDX structures in the body of answers.
Map CVE: from path traversal to desyringization
All three CISA KEV CVE sits in Top 5% on EPSS. These are not theoretical threats – these are actively exploited vectors.
According to the analysis of the researchers, the problem is supposedly related to the processing of file operations (a specific vulnerable component is not specified in NV advisory). Custom input is processed without canonicalization of the path, without checking the exit beyond the root directory and without sequence filtering ../ (CWE-22, Path Traversal)
CVSS-vector: CVSS:3.1/AV:N/AV:N/A:N/A:H/A:H/A:H/A:H/AH. Decryption: an attack over the network (AV:N), low complexity (AC:L), authentication is not needed (PR:N), the user's actions are not needed (UI:N), changed scopeS:C - the impact goes beyond the vulnerable component. Full impact on privacy, integrity and accessibility.
The result is coded execution (according to NVD). The proposed operation vector based on the patch analysis: path traversal is used as file write primitive, after which the CFML file in the web root gives an unauthenticated RCE with the rights of the ColdFusion service account.
Timeline of weapons:
• June 30, 2026 - Adobe releases patch (APSB26-68), closing 11 vulnerabilities, six of them with CVSS 10.0
• July 2, 2026 - Researchers publish a patch analysis (patch diff)
• Less than 2 hours later - according to available data, the first attempts of operation were recorded (specific IoC require a source check)
• July 7, 2026 - CISA adds CVE to KEV Catalog with "Act" (Exposition: active, Automable: yes, technical impact: total)
Two hours. From the publication of pap diff to the first attacks - two hours. If you were planning to put a patch next week, it’s too late.
Affected versions: ColdFusion 2025 Update 9 and earlier, ColdFusion 2023 Update 20 and earlier.
Predictions: the exact vulnerable component is not specified in NVD; the advisory is supposedly related to RDS (DSServlet), but this is not officially confirmed. Does not work if: used patch APSB26-68, WAF with custom rules inspects non-standard protocols. There is a nuance: standard WAF does not disassemble the body of binary RDS-queries - path traversal-signature (../, ..%2f) work only at the URL level.
In the same update APSB26-68 is closed CVE-2026-48276 and CVE-2026-48283 (both CWE-434, Unrestricted Upload of File with Dangerous Type, CVSS 10.0) CVE-2026-48277, CVE-2026-48281 and CVE-2026-48316 (All CWE-20, Improper Input Validation, CVSS 10.0). Six vulnerabilities with maximum rating in one update - such a critical-bug density for one product I do not remember.
EPSS 0.9851 - Top 1%, one of the most actively exploited ColdFusion Vulnerabilities.
Predictions (critical): admin panel should be available via the Internet. The NVD utters: "Exploration of this issue to require the admin panel be exposed to the internet.""To exploit this vulnerability, it is necessary that the administrative panel is available from the Internet." From here, AC:H (high complexity) in the CVSS vector is not because the exploit is complex, but because a specific condition of the environment is needed. For the same reason AC:H has been appropriated and CVE-2024-53961 - both require admin panel accessibility.
Most of the attackers used DigitalOcean Droplets, which were quickly blocked by the hoster.
What can be achieved with successful operation:
• neo-security.xml- hash passwords of ColdFusion administrator
• neo-datasource.xml- DB connection lines, including passwords
• password.properties- exed to decipher Data Source passwords
• web.xml- servlet configuration, useful for planning the next step
Affected versions: ColdFusion 2023 Update 6 and earlier, ColdFusion 2021 Update 12 and before.
CVE-2024-53961 (CVSS 8.1, High, CWE-22) - a similar story: path traversal. The NVD description indicates a file system system adhappy read, but CVSS vector (C:H/H/H/H/:H) involves the impact and integrity and availability - the discrepancy between the description and the vector should be clarified with NVD/Adobe. It also requires admin panel availability. According to unconfirmed reports, the PoC code for it could be available, which made patching a priority. EPSS 0.1340 (Top 5%).
CISA KEV describes it as "Deserialization of Untrusted Data Vulnerability" - there is a divergence of classifications: the NVD vector indicates only the impact on privacy (I:N/A:N), while CISA and NVD refer to the automatic code execution. CISA KEV since March 2023. According to inthewild.io, active operation lasts more than 1220 days.
Severity - High (CVSS 8.6), not Critical. CVSS vector:3.1/AV:N/C:C/C/N/A:N/A:N/A:N/N
N):N/N) indicates the effect only of privacy (I:N, A:N), which contradicts the wording of code execution in the NVD extreme description. Authentication is not required.Affected versions: ColdFusion 2018 Update 15 and earlier, ColdFusion 2021 Update 5 and earlier. Nuclei-stwelrd: http/cves/2023/CVE-2023-26360.yaml.
The 2025 Christmas Campaign Includes Operation CVE-2023-26360 in conjunction with other CVE: attackers cyclically sorted the vectors with an interval of 1-5 seconds, using JNDI/LDAP injection, presumably pushed through WDDX degeneration. To confirm the vulnerability of hosts, OAS-collabs were used through Interactsh (ProjectDiscovery) - a legitimate tool for OOB verification, which makes it difficult to detect by network artifacts.
Operation Chain and Place in Killing Chaeh
A typical ColdFusion attack fits into this sequence of MITRE AT&CK:
1. Recon - Shodan/nuclei, detection /CFIDE/Endpoints, definition of version
2. Exploit Public-Facing Application (T1190, Initial Access) - the application of one of the CVE
3. Credentials In Files (T1552.001, Credential Access) )- Remove configuration files through file read
4. Web Shell (T1505.003, Persistence) - downloading CFML-webshell via file
5. Windows Command Shell (T1059.003, Execution) - execution of commands on behalf of the service account
6. Ingress Tool Transfer (T1105, C2) )- downloading tunneling tools or C2-agents
7. Exploitation for Privilege Escalation (T1068) )- if necessary, increase privileges
