Is CVE-2023-26359 (Adobe ColdFusion Deserialization of Untrusted Data) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-26359 to its Known Exploited Vulnerabilities catalogue on 21 August 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.

What CISA listing means for CVE-2023-26359

CISA’s Known Exploited Vulnerabilities catalogue is a practical signal, not a theoretical one. For this CVE, the useful question is not whether the flaw exists, but whether exposure is still present anywhere in your estate, including forgotten internet-facing instances, lab systems, and embedded deployment paths that may have been missed by routine scanning.

Because the issue is Adobe ColdFusion deserialization of untrusted data, the operational concern is code execution in the current user context. That means even partial access can become a foothold for deeper compromise if the application runs with broad file, network, or service permissions.

When teams treat KEV as a patching queue rather than a containment signal, they miss the main security value: it identifies vulnerabilities that should already be assumed to be under active pressure. For internet-exposed application platforms, that usually means prioritising exposure reduction before waiting for perfect remediation windows.

Why deserialization flaws are especially dangerous

Deserialization bugs are high impact because the application is asked to reconstruct data into executable program state. If an attacker can influence that input, the flaw can bypass normal business logic and trigger unsafe behaviour that the developer never intended.

In practice, the severity depends on what the ColdFusion process can reach after execution starts. A constrained runtime limits damage, while an over-permissioned runtime can turn a single unsafe request into data theft, lateral movement, or persistence. The vulnerability type therefore matters as much as the initial entry point.

For responders, the key technical question is whether the vulnerable path is reachable from any network zone that an attacker can touch. If it is, assume exploit attempts are plausible and verify whether the instance is exposed, patched, mitigated, or isolated.

How to triage exposure and limit blast radius

The fastest useful triage is asset confirmation, not log speculation. Confirm which ColdFusion instances exist, which are internet-facing, which business services depend on them, and whether any instance is still running with default or broadly privileged service accounts.

Where patching is delayed, limit reachability first. Segmentation, temporary access restrictions, reverse proxy controls, and tight host permissions reduce the value of a successful exploit even before the code issue is fixed. For application platforms, reducing reachable surface is often the only credible short-term mitigation.

After exposure is narrowed, check for evidence of command execution, unusual child processes, new files, suspicious outbound connections, and changes to application or service configuration. Those are often more actionable than waiting for a perfect signature of the exploit itself.

Risk and Threat Considerations

This flaw matters because active exploitation changes the decision threshold. Once a vulnerability is known to be used in the wild, the risk is no longer just compromise of one server, but also the secondary exposure that follows from application-level code execution on a trusted platform.

Failure mechanism: An attacker sends crafted input to the ColdFusion deserialization path, gains execution in the application context, and then uses that foothold to enumerate the host, access adjacent services, or stage follow-on activity.

Impact: The immediate result can be application compromise, but the larger concern is whatever the runtime account can reach, including data stores, internal services, secrets on disk, and administrative interfaces that should not have been exposed to an attacker.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes rapid discovery and remediation central to this CVE.
Recommendation — Prioritise, track, and remediate this KEV-listed vulnerability on exposed assets first.
NIST CSF 2.0	PR.PS-05 — Backups and Recovery	Patch delay and compromise checks depend on preserving service resilience and recovery options.
Recommendation — Ensure recovery options and rollback paths are ready before major ColdFusion changes.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This is a remediated software flaw with active exploitation requiring disciplined fix handling.
	SI-4 — System Monitoring	Post-exploitation hunting depends on monitoring for suspicious execution and network activity.
Recommendation — Apply, verify, and track remediation for the vulnerable ColdFusion deployment. Monitor the ColdFusion host for signs of exploit attempts and follow-on execution.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	A publicly exploited vulnerability requires prioritised vulnerability management and verification.
Recommendation — Classify, prioritise, and verify remediation for exposed ColdFusion instances.

Practitioner Guidance

What to prioritise: Treat any externally reachable ColdFusion instance as a high-priority exposure review item. If you cannot verify the instance is patched or shielded, move it ahead of routine vulnerability backlogs and confirm whether compensating controls are actually in place.

What to verify: Check whether the vulnerable application path is reachable, whether the service account has unnecessary local or network privileges, and whether logging is sufficient to reconstruct requests, process launches, and outbound connections around the suspected window.

Decision rule: If patching must wait, reduce exposure first, then hunt for earlier compromise. If the host or application already shows signs of suspicious execution, treat credential rotation, session invalidation, and service-account review as part of containment, not as a separate cleanup phase.

Practitioner takeaway: For KEV-listed application flaws, the question is usually not “is it vulnerable?” but “what else can the attacker do after one successful request?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org