#coldfusion

Analysis · May 20, 2026 · analysis-desk

Adobe ColdFusion has been getting popped the same ways for 15 years

The KEV catalog holds a long run of ColdFusion bugs: deserialization RCEs, access-control bypasses, and file uploads, from 2013 to 2024. Different CVEs, same handful of weaknesses. If you still run internet-facing ColdFusion, you're operating a perennial target.