Class familyAdobe · ColdFusion
Adobe ColdFusion access control flaws, 2023–2026
14 ColdFusion CVEs with CWE-284 weaknesses, 23 Mar 2023 to 8 Sep 2026. 4 are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
6 2023’23
2 2024’24
5 2025’25
1 2026’26
In CISA KEVNot in KEV
20236 CVEs, 3 in KEV
20242 CVEs, 1 in KEV
20255 CVEs
20261 CVE
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2023-26360KEV | 23 Mar 2023 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Grouped by weakness | 69.0 |
| CVE-2023-29298KEV | 12 Jul 2023 | Adobe ColdFusion Improper Access Control Vulnerability | Grouped by weakness | 68.2 |
| CVE-2021-40699 | 7 Sep 2023 | ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation | Grouped by weakness | 13.9 |
| CVE-2023-38205KEV | 14 Sep 2023 | Adobe ColdFusion Improper Access Control Vulnerability | Grouped by weakness | 68.2 |
| CVE-2023-38206 | 14 Sep 2023 | ColdFusion | Improper Access Control (CWE-284) | Grouped by weakness | 14.4 |
| CVE-2023-26347 | 17 Nov 2023 | CVE-2023-38205 issues | ColdFusion Admin Panel Access | Grouped by weakness | 65.1 |
| CVE-2024-20767KEV | 18 Mar 2024 | Adobe ColdFusion Improper Access Control Vulnerability | Grouped by weakness | 68.2 |
| CVE-2024-34112 | 13 Jun 2024 | ColdFusion CFDOCUMENT file retrieval / access control bypass | Grouped by weakness | 24.8 |
| CVE-2025-30281 | 8 Apr 2025 | ColdFusion | Improper Access Control (CWE-284) | Grouped by weakness | 25.9 |
| CVE-2025-30288 | 8 Apr 2025 | ColdFusion | Improper Access Control (CWE-284) | Grouped by weakness | 10.9 |
| CVE-2025-43563 | 13 May 2025 | ColdFusion | Improper Access Control (CWE-284) | Grouped by weakness | 25.8 |
| CVE-2025-49546 | 8 Jul 2025 | ColdFusion | Improper Access Control (CWE-284) | Grouped by weakness | 9.9 |
| CVE-2025-64897 | 9 Dec 2025 | ColdFusion | Improper Access Control (CWE-284) | Grouped by weakness | 4.4 |
| CVE-2026-75998 | 8 Sep 2026 | ColdFusion | Improper Access Control (CWE-284) | Grouped by weakness | 16.7 |