Is CVE-2023-26360 (Adobe ColdFusion Deserialization of Untrusted Data) being exploited in the wild?

What “Exploited in the Wild” Means for This CVE

For a vulnerability question like this, the practical issue is not only whether a flaw exists, but whether attackers are already using it against real targets. CISA’s KEV catalogue is the most important signal here because it is reserved for vulnerabilities with confirmed active exploitation, which changes urgency from routine patching to immediate response. For broader triage context, see the CISA Known Exploited Vulnerabilities Catalog and the CVE Program.

That distinction matters because exploited-in-the-wild vulnerabilities can move from disclosure to mass exploitation quickly, especially when the flaw enables remote code execution. In this case, the product and weakness described in the direct answer make exposure materially more urgent than a purely theoretical bug.

How to Confirm Exposure and Judge Urgency

The first question for defenders is whether any internet-facing or internally reachable Adobe ColdFusion instance is present in the environment, including neglected test, staging, or legacy hosts. If the product is present, treat the system as high priority until you can verify version status, ownership, and whether any compensating controls meaningfully reduce reachability.

When a CVE is in KEV, use the vendor advisory and CISA guidance for exact remediation details rather than relying on secondary summaries. For discovery and prioritisation, it is also reasonable to cross-check exploit likelihood and patch sequencing against the NIST National Vulnerability Database and, where your programme uses it, FIRST EPSS.

What to Do if Patching Must Wait

If immediate remediation is blocked by change windows, dependency testing, or operational constraints, reduce exposure instead of treating the delay as acceptable. The priority is to make exploitation harder to reach and easier to spot, especially on externally exposed systems where deserialization flaws are most attractive to attackers.

That usually means limiting network access, tightening administrative paths, removing unnecessary public reachability, and increasing monitoring on the affected application and adjacent infrastructure. If the system cannot be patched quickly, treat the interim state as an exception that needs explicit risk ownership and a short expiration date.

Risk and Threat Considerations

deserialization of untrusted data is dangerous because it can turn a crafted input into code execution, not just application instability. Once a vulnerable ColdFusion instance is reachable, the main risk is that an attacker can convert a single request into server-side execution and then use that foothold for persistence, lateral movement, or data theft.

Failure mechanism: The application accepts attacker-controlled serialized data and processes it in a way that permits unsafe object construction or gadget-chain execution, which can lead to remote code execution.

Impact: A successful exploit can give the attacker control of the server, expose application data and credentials, and create a path to broader compromise if the host is trusted inside the network.

Practitioner Guidance

What to verify: Confirm whether any ColdFusion instance is still exposed, whether the host is internet-facing, and whether logging captures the time window around first public exploitation reports. If you do not know whether the system was reachable during that window, assume you need compromise checks, not just patch verification.

Decision rule: If the asset can be exploited remotely and has not been remediated, prioritise isolation or patching before lower-severity vulnerability work. If patching is delayed, treat the system as a potential intrusion candidate and validate for webshells, unexpected admin changes, and anomalous outbound connections.

Practitioner takeaway: KEV listing means you should assume active attacker interest, so the right question is not whether the flaw is real, but whether the exposed system has already crossed from vulnerability management into incident response.

Related resources from NHI Mgmt Group

• Guide: Zero-Day and Exploited Vulnerabilities Guide
• Is CVE-2023-29300 (Adobe ColdFusion Deserialization of Untrusted Data) being exploited in the wild?
• Is CVE-2023-38203 (Adobe ColdFusion Deserialization of Untrusted Data) being exploited in the wild?
• Is CVE-2023-26359 (Adobe ColdFusion Deserialization of Untrusted Data) being exploited in the wild?
• CVE-2023-26360 (Adobe ColdFusion Deserialization of Untrusted Data)