CVE‑2023‑26359: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability Leads to Remote Code Execution
What It Is – Adobe ColdFusion versions 2021‑2023 contain an insecure deserialization flaw that allows an attacker to supply crafted data that the server will deserialize and execute as code in the context of the current user.
Exploitability – The vulnerability is exploitable remotely when an application accepts untrusted serialized objects (e.g., via HTTP parameters). No public exploit has been observed, but a proof‑of‑concept exists and the CVSS 3.1 base score is 8.8 (High).
Affected Products – Adobe ColdFusion 2021, 2022, 2023 (all releases prior to the December 2023 security update).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for secure development and code‑integrity controls (input validation, safe deserialization, code review) that can be mapped to a single VCF control objective and satisfy many frameworks (e.g., NIST CSF 2.0, ISO 27001).
- Continuous evidence of patch management and runtime protection provides a defensible audit trail that enterprise buyers increasingly demand.
- A failure to remediate this flaw can break the trust chain between a SaaS provider and its customers, exposing downstream data‑processing contracts.
Recommended Actions
- Apply Adobe’s December 2023 security patch for ColdFusion immediately.
- Conduct a targeted code review of any custom deserialization logic; replace unsafe libraries with vetted alternatives.
- Enable runtime application self‑protection (RASP) or Web Application Firewalls that can block malicious serialized payloads.
- Update your asset inventory and control‑mapping repository to reflect the newly patched component; capture the patch‑install log as evidence for audit readiness.
Source: CISA KEV – CVE‑2023‑26359