ColdFusion vulnerabilities | LiveThreat CVE Feed

App Server

ColdFusion

by Adobe · last CVE Oct 13, 2026

On CISA KEVExploited in the wildRansomware-linked

296

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities296 In the news10 Timeline

Severity mix

Critical 81High 99Medium 49Low 5

Severity

All severities296 Critical81 High99 Medium49 Low5

Exploitation

On CISA KEV17 Exploited in the wild17

Watch

Add ColdFusion to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-47930	8.1	1%	Jun 9	ColdFusion \| Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more
CVE-2024-53961	8.1	14%	Dec 23	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 2021.17
CVE-2025-49537	7.9	2%	Jul 8	ColdFusion \| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) Affected: through 2021.20
CVE-2026-106614	7.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more
CVE-2026-25652	7.8	0%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more
CVE-2020-10145	7.8	1%	May 27	The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\ Affected: 2016; 2018; 2021
CVE-2020-9673	7.8	1%	Jul 17	Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +20 more
CVE-2020-9672	7.8	1%	Jul 17	Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +20 more
CVE-2020-3768	7.8	1%	Jun 26	ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +18 more
CVE-2018-4938	7.8	1%	May 19	Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Insecure Library Loading vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +14 more
CVE-2026-34633	7.7	0%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more
CVE-2026-105994	7.7	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more
CVE-2026-48385	7.7	2%	Aug 11	ColdFusion \| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more
CVE-2026-48332	7.7	1%	Jul 14	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more
CVE-2026-48328	7.7	1%	Jul 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more
CVE-2026-34619	7.7	8%	Apr 14	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more
CVE-2026-75748	7.6	0%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more
CVE-2026-75996	7.5	1%	Oct 13	ColdFusion \| Uncontrolled Resource Consumption (CWE-400) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more
CVE-2026-105900	7.5	1%	Oct 13	ColdFusion \| Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more
CVE-2026-106623	7.5	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more
CVE-2026-75998	7.5	1%	Sep 8	ColdFusion \| Improper Access Control (CWE-284) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more
CVE-2026-48386	7.5	1%	Aug 11	ColdFusion \| Use of a Broken or Risky Cryptographic Algorithm (CWE-327) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more
CVE-2026-27282	7.5	1%	Apr 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more
CVE-2024-45113	7.5	1%	Sep 13	ColdFusion \| Improper Authentication (CWE-287) Affected: through 2021.12
CVE-2024-34112	7.5	24%	Jun 13	ColdFusion CFDOCUMENT file retrieval / access control bypass Affected: through 2021u13
CVE-2023-26347	7.5	10%	Nov 17	CVE-2023-38205 issues \| ColdFusion Admin Panel Access Affected: through 2021.11
CVE-2023-29301	7.5	35%	Jul 12	Adobe ColdFusion Improper Restriction of Excessive Authentication Attempts Security feature bypass Affected: through 2023.0.0.330468
CVE-2022-42341	7.5	36%	Oct 14	Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read Affected: through CF2021U4; through CF2018u14; through None
CVE-2022-42340	7.5	34%	Oct 14	Adobe ColdFusion Improper Input Validation Arbitrary file system read Affected: through CF2021U4; through CF2018u14; through None
CVE-2022-38422	7.5	45%	Oct 14	Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability Affected: through CF2021U4; through CF2018u14; through None
CVE-2022-38419	7.5	54%	Oct 14	Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read Affected: through CF2021U4; through CF2018u14; through None
CVE-2022-38420	7.5	45%	Oct 14	Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service Affected: through CF2021U4; through CF2018u14; through None
CVE-2020-3761	7.5	4%	Mar 25	ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +16 more
CVE-2019-8072	7.5	7%	Sep 27	ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Security bypass vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +11 more
CVE-2018-15964	7.5	8%	Sep 25	Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +17 more
CVE-2018-15960	7.5	6%	Sep 25	Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +17 more
CVE-2018-4942	7.5	4%	May 19	Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +14 more
CVE-2017-11286	7.5	10%	Dec 1	Adobe ColdFusion has an XML external entity (XXE) injection vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +12 more
CVE-2026-47960	7.4	0%	Jun 9	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more
CVE-2025-61813	7.4	1%	Dec 9	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 2025.4; through 2023.16; through 2021.22
CVE-2025-49538	7.4	2%	Jul 8	ColdFusion \| XML Injection (aka Blind XPath Injection) (CWE-91) Affected: through 2021.20
CVE-2021-40699	7.4	1%	Sep 7	ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation Affected: through 2018.11
CVE-2021-40698	7.4	1%	Sep 7	ColdFusion Use of Inherently Dangerous Function Leads To Security feature bypass Affected: through 2018.11
CVE-2026-71383	7.3	1%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more
CVE-2025-49536	7.3	0%	Jul 8	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2021.20
CVE-2022-38424	7.2	46%	Oct 14	Adobe ColdFusion Application Server Directory Traversal Arbitrary file system write Affected: through CF2021U4; through CF2018u14; through None
CVE-2022-38421	7.2	80%	Oct 14	Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability Affected: through CF2021U4; through CF2018u14; through None
CVE-2026-76001	7.1	0%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more
CVE-2026-83961	7.1	0%	Sep 3	ColdFusion \| Improper Authentication (CWE-287) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more