ColdFusion vulnerabilities | LiveThreat CVE Feed

App Server

ColdFusion

by Adobe · last CVE Oct 13, 2026

On CISA KEVExploited in the wildRansomware-linked

296

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities296 In the news10 Timeline

Severity mix

Critical 81High 99Medium 49Low 5

Severity

All severities296 Critical81 High99 Medium49 Low5

Exploitation

On CISA KEV17 Exploited in the wild17

Watch

Add ColdFusion to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-105900	7.5	1%	Oct 13	ColdFusion \| Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more
CVE-2026-106623	7.5	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more
CVE-2026-75998	7.5	1%	Sep 8	ColdFusion \| Improper Access Control (CWE-284) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more
CVE-2026-48386	7.5	1%	Aug 11	ColdFusion \| Use of a Broken or Risky Cryptographic Algorithm (CWE-327) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more
CVE-2026-27282	7.5	1%	Apr 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more
CVE-2024-45113	7.5	1%	Sep 13	ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation Affected: 2023; 2023; 2023; 2023; 2023; 2023; +14 more
CVE-2024-34112	7.5	24%	Jun 13	ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read Affected: 2021; 2021; 2021; 2021; 2021; 2021; +16 more
CVE-2023-26347	7.5	10%	Nov 17	Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: before 2021; 2021; 2021; 2021; 2021; 2021; +13 more
CVE-2023-29301	7.5	35%	Jul 12	Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Restriction of Excessive Authentication… Affected: 2023 through 2023.0.0.330468; 2018; 2018; 2018; 2018; 2018; +19 more
CVE-2022-42341	7.5	36%	Oct 14	Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read Affected: through CF2021U4; through CF2018u14; through None
CVE-2022-42340	7.5	34%	Oct 14	Adobe ColdFusion Improper Input Validation Arbitrary file system read Affected: through CF2021U4; through CF2018u14; through None
CVE-2022-38422	7.5	45%	Oct 14	Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability Affected: through CF2021U4; through CF2018u14; through None
CVE-2022-38419	7.5	54%	Oct 14	Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read Affected: through CF2021U4; through CF2018u14; through None
CVE-2022-38420	7.5	45%	Oct 14	Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service Affected: through CF2021U4; through CF2018u14; through None
CVE-2020-3761	7.5	4%	Mar 25	ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +16 more
CVE-2019-8072	7.5	7%	Sep 27	ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Security bypass vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +11 more
CVE-2018-15964	7.5	8%	Sep 25	Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +17 more
CVE-2018-15960	7.5	6%	Sep 25	Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +17 more
CVE-2018-4942	7.5	4%	May 19	Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +14 more
CVE-2017-11286	7.5	10%	Dec 1	Adobe ColdFusion has an XML external entity (XXE) injection vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +12 more
CVE-2026-47960	7.4	0%	Jun 9	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more
CVE-2025-61813	7.4	1%	Dec 9	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 2025.4; through 2023.16; through 2021.22
CVE-2025-49538	7.4	2%	Jul 8	ColdFusion \| XML Injection (aka Blind XPath Injection) (CWE-91) Affected: through 2021.20
CVE-2021-40699	7.4	1%	Sep 7	ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE… Affected: before 2018; 2018; 2018; 2018; 2018; 2018; +7 more
CVE-2021-40698	7.4	1%	Sep 7	ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security… Affected: before 2018; 2018; 2018; 2018; 2018; 2018; +7 more
CVE-2026-71383	7.3	1%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more
CVE-2025-49536	7.3	0%	Jul 8	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2021.20
CVE-2022-38424	7.2	46%	Oct 14	Adobe ColdFusion Application Server Directory Traversal Arbitrary file system write Affected: through CF2021U4; through CF2018u14; through None
CVE-2022-38421	7.2	80%	Oct 14	Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability Affected: through CF2021U4; through CF2018u14; through None
CVE-2026-76001	7.1	0%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more
CVE-2026-83961	7.1	0%	Sep 3	ColdFusion \| Improper Authentication (CWE-287) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more
CVE-2026-48338	6.8	0%	Jul 14	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more
CVE-2025-61821	6.8	1%	Dec 9	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 2021.22
CVE-2025-49544	6.8	1%	Jul 8	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 2021.20
CVE-2025-43566	6.8	58%	May 13	ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +30 more
CVE-2025-30294	6.8	17%	Apr 8	ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more
CVE-2025-30293	6.8	1%	Apr 8	ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more
CVE-2026-76000	6.5	0%	Sep 8	ColdFusion \| Uncontrolled Resource Consumption (CWE-400) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more
CVE-2026-48375	6.5	1%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more
CVE-2026-48314	6.5	1%	Jun 30	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more
CVE-2020-3796	6.5	4%	Jun 26	ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an improper access control vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +18 more
CVE-2020-3767	6.5	3%	Jun 26	ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +18 more
CVE-2025-61822	6.2	1%	Dec 9	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2021.22
CVE-2025-61823	6.2	0%	Dec 9	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 2021.22
CVE-2025-49545	6.2	0%	Jul 8	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2021.20
CVE-2026-76002	6.1	0%	Sep 8	ColdFusion \| Cross-site Scripting (Reflected XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more
CVE-2025-30292	6.1	16%	Apr 8	ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more
CVE-2023-44352	6.1	85%	Nov 17	Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability Affected: before 2021; 2021; 2021; 2021; 2021; 2021; +13 more
CVE-2022-28818	6.1	45%	May 12	ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability Affected: before 2018; 2018; 2018; 2018; 2018; 2018; +13 more
CVE-2019-7092	6.1	2%	May 24	ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cross site scripting vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +20 more