ColdFusion vulnerabilities | LiveThreat CVE Feed

App Server

ColdFusion

by Adobe · last CVE Oct 13, 2026

On CISA KEVExploited in the wildRansomware-linked

296

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities296 In the news10 Timeline

Severity mix

Critical 81High 99Medium 49Low 5

Severity

All severities296 Critical81 High99 Medium49 Low5

Exploitation

On CISA KEV17 Exploited in the wild17

Watch

Add ColdFusion to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2016-1114	9.8	9%	May 11	Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object,… Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +22 more
CVE-2026-75994	9.6	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more
CVE-2026-106620	9.6	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more
CVE-2026-71384	9.6	0%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more
CVE-2026-48284	9.6	0%	Jul 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more
CVE-2026-47928	9.6	2%	Jun 9	ColdFusion \| Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more
CVE-2026-48321	9.3	0%	Jul 14	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more
CVE-2026-48325	9.3	1%	Jul 14	ColdFusion \| Missing Authentication for Critical Function (CWE-306) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more
CVE-2026-48315	9.3	1%	Jun 30	ColdFusion \| Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more
CVE-2026-48313	9.3	3%	Jun 30	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more
CVE-2026-27304	9.3	4%	Apr 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more
CVE-2025-49535	9.3	1%	Jul 8	ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more
CVE-2026-106621	9.1	1%	Oct 13	ColdFusion \| Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more
CVE-2026-75746	9.1	1%	Sep 8	ColdFusion \| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more
CVE-2026-48324	9.1	1%	Jul 14	ColdFusion \| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more
CVE-2026-48319	9.1	1%	Jul 14	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more
CVE-2025-61811	9.1	1%	Dec 10	ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +34 more
CVE-2025-61809	9.1	1%	Dec 10	ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass Affected: 2021; 2021; 2021; 2021; 2021; 2021; +34 more
CVE-2025-61808	9.1	11%	Dec 10	ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +34 more
CVE-2025-43564	9.1	17%	May 13	ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read Affected: 2021; 2021; 2021; 2021; 2021; 2021; +30 more
CVE-2025-43563	9.1	17%	May 13	ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read Affected: 2021; 2021; 2021; 2021; 2021; 2021; +30 more
CVE-2025-43562	9.1	51%	May 13	ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +30 more
CVE-2025-43561	9.1	24%	May 13	ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +30 more
CVE-2025-43560	9.1	23%	May 13	ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +30 more
CVE-2025-43559	9.1	2%	May 13	ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +30 more
CVE-2025-30282	9.1	2%	Apr 8	ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more
CVE-2025-30281	9.1	24%	Apr 8	ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more
CVE-2025-24447	9.1	2%	Apr 8	ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more
CVE-2025-24446	9.1	2%	Apr 8	ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more
CVE-2026-106619	9.0	1%	Oct 13	ColdFusion \| Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more
CVE-2026-48327	9.0	0%	Jul 14	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more