CVE-2021-40699: ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-07 · updated 2026-06-17
Weakness: CWE-284

Description

ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.

Affected products

Adobe ColdFusion: before 2018; 2018, 2018-update1, 2018-update10, 2018-update2, 2018-update3, 2018-update4 (+6) — fixed in 2018

How to fix

Upgrade to a fixed version: Adobe ColdFusion 2018. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-40699 or the next vulnerability affects your stack