Adobe.ColdFusion.ToTemplateProxy.Insecure.Deserialization

Description

This indicates an attack attempt to exploit an Insecure Deserialization Vulnerability in Adobe Systems ColdFusion.
The vulnerability is due to deserialization of untrusted data when processing HTTP parameters sent to ColdFusion Component (CFC) endpoints. A remote, unauthenticated, attacker could exploit this vulnerability by sending crafted requests to the target server. Successful exploitation could result in arbitrary code execution in the security context of SYSTEM.

Outbreak Alert

FortiGuard Labs continue to see cyber-attacks targeting to exploit the ColdFusion vulnerability CVE-2023-26360. Blocking over multiple hundreds of attacks over the last weeks.

View the full Outbreak Alert Report

Affected Products

Adobe Systems ColdFusion 2018 update 15 and prior
Adobe Systems ColdFusion 2021 update 5 and prior

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html

CVE References