CVE-2023-29298

nvd.nist.gov • June 29, 2026

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Access Control Bypass in Adobe ColdFusion (CVE-2023-29298) Rapid7 disclosed an access control bypass vulnerability in Adobe ColdFusion, identified as CVE-2023-29298, which affects versions 2018u16, 2021u6, and 2023. The vulnerability allows attackers to access restricted administration endpoints by manipulating URL requests. This flaw undermines the security guarantees of ColdFusion's Secure Profile, exposing 437 CFM and 96 CFC files. Exploitation does not require user interaction, increasing the risk of unauthorized access to sensitive resources. Adobe has released patches in APSB23-40 to address this issue. The vulnerability was reported to Adobe on April 11, 2023, and was published on July 12, 2023. It was added to the CISA Known Exploited Vulnerabilities Catalog on July 20, 2023. 60 sources 73

Extracted Entities

CVEs (1)

CVE-2023-29298

Platforms (1)

Adobe ColdFusion