What’s Vulnerable › Products

Adobe ColdFusion vulnerabilities

296 known vulnerabilities, 17 confirmed exploited in the wild (CISA KEV), 144 published in the last 12 months.

Check whether your Adobe ColdFusion version is affected

Exploited Adobe ColdFusion vulnerabilities

• CVE-2026-48282 — Adobe ColdFusion Path Traversal Vulnerability
• CVE-2017-3066 — Adobe ColdFusion Deserialization Vulnerability
• CVE-2024-20767 — Adobe ColdFusion Improper Access Control Vulnerability
• CVE-2023-38203 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
• CVE-2023-29300 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
• CVE-2023-26359 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
• CVE-2023-38205 — Adobe ColdFusion Improper Access Control Vulnerability
• CVE-2023-29298 — Adobe ColdFusion Improper Access Control Vulnerability
• CVE-2023-26360 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
• CVE-2010-2861 — Adobe ColdFusion Directory Traversal Vulnerability
• CVE-2013-0631 — Adobe ColdFusion Information Disclosure Vulnerability
• CVE-2013-0629 — Adobe ColdFusion Directory Traversal Vulnerability
• CVE-2013-0625 — Adobe ColdFusion Authentication Bypass Vulnerability
• CVE-2009-3960 — Adobe BlazeDS Information Disclosure Vulnerability
• CVE-2013-0632 — Adobe ColdFusion Authentication Bypass Vulnerability
• CVE-2018-4939 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
• CVE-2018-15961 — Adobe ColdFusion Unrestricted File Upload Vulnerability

Latest Adobe ColdFusion vulnerabilities

• CVE-2026-76001 — ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 7.1)
• CVE-2026-75996 — ColdFusion | Uncontrolled Resource Consumption (CWE-400) (CVSS 7.5)
• CVE-2026-75995 — ColdFusion | Improper Input Validation (CWE-20) (CVSS 8.4)
• CVE-2026-75994 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 9.6)
• CVE-2026-75748 — ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 7.6)
• CVE-2026-71385 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 8.4)
• CVE-2026-34634 — ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 8.6)
• CVE-2026-34633 — ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 7.7)
• CVE-2026-106624 — ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0)
• CVE-2026-106623 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 7.5)
• CVE-2026-106622 — ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 10.0)
• CVE-2026-106621 — ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 9.1)
• CVE-2026-106620 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 9.6)
• CVE-2026-106619 — ColdFusion | Improper Input Validation (CWE-20) (CVSS 9.0)
• CVE-2026-106618 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 8.8)
• CVE-2026-106617 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 8.8)
• CVE-2026-106616 — ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (CVSS 8.6)
• CVE-2026-106615 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 8.8)
• CVE-2026-106614 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 7.8)
• CVE-2026-106613 — ColdFusion | Improper Input Validation (CWE-20) (CVSS 8.8)
• CVE-2026-106612 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 9.9)
• CVE-2026-106090 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 8.8)
• CVE-2026-106089 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 8.8)
• CVE-2026-105994 — ColdFusion | Incorrect Authorization (CWE-863) (CVSS 7.7)
• CVE-2026-105903 — ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 9.9)