Adobe ColdFusion 2025/2023 Security Update: Multiple High-CVSS Vulnerabilities (RCE/SQLi/XSS)

Adobe Security Bulletin Summary Vulnerability Overview Adobe has released security updates for ColdFusion 2025 and 2023. These updates address critical, important, and moderate severity vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system reading, and security feature bypasses. Affected Versions ColdFusion 2025: Update 10 and earlier ColdFusion 2023: Update 21 and earlier Remediation ColdFusion 2025: Update to version 11 ColdFusion 2023: Update to version 22 Vulnerability Details Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) (CVE-22) - CVSS Score: 9.9 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVE Number: CVE-2026-40318 Improper Control of Generation of Code (Code Injection) (CVE-21) - CVSS Score: 9.6 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVE Number: CVE-2026-40322 Improper Input Validation (CVE-20) - CVSS Score: 9.6 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVE Number: CVE-2026-40284 Incorrect Authorization (CVE-051) - CVSS Score: 9.3 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVE Number: CVE-2026-40321 Missing Authentication for Critical Function (CVE-206) - CVSS Score: 9.3 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVE Number: CVE-2026-40325 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) (CVE-22) - CVSS Score: 9.1 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVE Number: CVE-2026-40319 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) (CVE-89) - CVSS Score: 9.1 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVE Number: CVE-2026-40324 Incorrect Authorization (CVE-053) - CVSS Score: 9.0 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVE Number: CVE-2026-40327 Cross-site Scripting (Reflected XSS) (CVE-29) - CVSS Score: 8.5 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - CVE Number: CVE-2026-40320 Improper Input Validation (CVE-20) - CVSS Score: 7.7 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - CVE Number: CVE-2026-40328 Server-Side Request Forgery (SSRF) (CVE-218) - CVSS Score: 7.7 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - CVE Number: CVE-2026-40332 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) (CVE-22) - CVSS Score: 6.8 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - CVE Number: CVE-2026-40338 Insufficient Session Expiration (CVE-613) - CVSS Score: 7.0 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVE Number: CVE-2026-40329 Acknowledgments Adobe thanks the following researchers for reporting these issues and working with Adobe to protect its customers: Matan Sander (matans1) and 2Bsecure - CVE-2026-40320 Tahmid Akbar Omim (imperial_coder) - CVE-2026-40327 Rajin Hasnine (retro__) - CVE-2026-40329 Notes It is recommended to use the latest Java connector. Review the updated serialization filter documentation to prevent insecure deserialization attacks. Update the ColdFusion JDK/JRE LTS versions to the latest release. Apply security configuration settings, including the ColdFusion Security Guide and Lockdown Guides. ColdFusion JDK Requirement ColdFusion 2025 (version 2023.0.0.331305) and above - Set JVM flag: ColdFusion 2023 (version 2023.0.0.330408) and above - Set JVM flag: ColdFusion 2021 (version 2021.0.0.323925) and above - Set JVM flag: Additional Information Visit https://helpx.adobe.com/security.html Or send an email to PSIRT@adobe.com --- Note: POC code or exploit code is not included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

Adobe ColdFusion 2025/2023 Security Update: Multiple High-CVSS Vulnerabilities (RCE/SQLi/XSS)