CVE-2023-26360 is a deserialization of untrusted data vulnerability in Adobe ColdFusion. CISA added it to the Known Exploited Vulnerabilities catalogue on 15 March 2023, which means attackers have used it in real attacks. Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.
What the vulnerability means in practice
Deserialization flaws are dangerous because they let an application turn attacker-controlled data back into executable objects or trusted state. In a product like Adobe ColdFusion, that can become remote code execution if the application accepts crafted input and processes it before validation.
For defenders, the key issue is not just the CVE label, but the trust boundary it breaks. A successful exploit can convert what should have been inert serialized data into server-side execution, which is why exploited deserialization issues are treated as high-priority internet-facing exposure.
Why this class of flaw is so harmful
Deserialization bugs are often severe because they sit deep in the request-processing path and may be reachable before normal authentication or business logic checks fully apply. That makes them attractive to attackers looking for direct code execution, especially when the vulnerable service is exposed to the internet.
Once exploitation succeeds, the attacker can often execute commands with the privileges of the application process. That can lead to web shell deployment, data theft, lateral movement, or further compromise of the host and nearby systems.
How organisations assess exposure and reduce risk
Exposure checks should start with an accurate inventory of where Adobe ColdFusion is deployed, which instances are internet-facing, and which environments are reachable from untrusted networks. Vendor advisories and the CISA KEV catalogue should be the first stop for authoritative patch and prioritisation guidance, alongside internal asset scoping and internet exposure review.
If patching cannot happen immediately, compensating controls matter: restrict network access to the application, reduce exposure of management interfaces, segment the host, and monitor for unusual requests or process behaviour. A disciplined vulnerability management process helps ensure a KEV-listed issue is tracked from discovery through verification rather than left as an open exception.
Detection, compromise review, and identity impact
Because this vulnerability is known to be exploited in the wild, detection should not stop at patch confirmation. Review web logs, application logs, command execution telemetry, and any sign of unexpected child processes, file writes, or new remote access paths on affected hosts.
If exploitation is suspected, treat the event as a host compromise, not just an application bug. Rebuild or reimage where needed, then review adjacent secrets and credentials that may have been exposed on the server, including service accounts, API keys, session material, and administrative credentials that the application could access.
Risk and Threat Considerations
Exploited deserialization flaws are especially dangerous because they can give an attacker direct execution on a server that may already hold sensitive application data or privileged access paths. In practice, that can turn a single web-facing flaw into a foothold for persistence, credential access, and later movement across the environment.
Failure mechanism: The attacker sends crafted serialized input that the application trusts and reconstructs into an object graph or action path that leads to code execution.
Impact: The server can be commandeered, sensitive data can be accessed, and credentials or tokens on the host may need to be rotated after containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA-01 — Risk Identification | ColdFusion exploitation risk must be identified and prioritised from exposure and KEV status |
| Recommendation — Identify internet-exposed ColdFusion assets and prioritise the KEV-listed flaw for remediation. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This CVE requires timely remediation and verification after patching |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detection and post-exploit review depend on reviewing logs and security telemetry | |
| SC-7 — Boundary Protection | Compensating controls for an exploitable internet-facing service rely on restricting exposure | |
| Recommendation — Remediate the vulnerable ColdFusion instance and verify the fix on all affected hosts. Review application and host logs for exploit indicators and post-compromise activity. Restrict network exposure to the ColdFusion service until remediation is complete. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed vulnerabilities require continuous tracking, prioritisation and verification |
| Recommendation — Track the CVE in your vulnerability programme and confirm remediation evidence after patching. | ||
Practitioner Guidance
Why practitioners should care: This is a prioritisation issue as much as a patching issue. A KEV-listed deserialization bug on an exposed application should be handled as active exploitation risk, with remediation urgency driven by internet reachability, business criticality, and the presence of sensitive data or privileged integrations on the host.
What to watch for: Look for unexplained process launches, abnormal outbound connections, unexpected new files, and signs that the application server has been used as a staging point rather than merely probed. If compromise is confirmed or strongly suspected, preserve evidence, then focus on containment, rebuild, and rotation of any secrets or service identities that could have been reachable from the affected system.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org