ColdFusion vulnerabilities: known CVEs & security history
Adobe · Actively exploited · 296 tracked CVEs · 17 actively exploited · updated November 2026 · what is a CVE? →
This is the full list of known vulnerabilities (CVEs) across all ColdFusion release lines — 296 in total, with 17 actively exploited in the wild. A CVE here doesn't mean your version is affected — check ColdFusion's current status and the safe version to run.
Known ColdFusion CVEs
Actively-exploited and most-severe first. Showing the top 80 of 296. Open any CVE for full details.
| CVE | Severity | CVSS | EPSS | Year |
|---|---|---|---|---|
| CVE-2026-48282⚡ exploited | critical | 10 | 42% | 2026 |
| CVE-2023-38203⚡ exploited | critical | 9.8 | 97% | 2023 |
| CVE-2023-29300⚡ exploited | critical | 9.8 | 100% | 2023 |
| CVE-2023-26359⚡ exploited | critical | 9.8 | 17% | 2023 |
| CVE-2018-15961⚡ exploited | critical | 9.8 | 100% | 2018 |
| CVE-2018-4939⚡ exploited | critical | 9.8 | 62% | 2018 |
| CVE-2017-3066⚡ exploited | critical | 9.8 | 91% | 2017 |
| CVE-2013-0632⚡ exploited | critical | 9.8 | 93% | 2013 |
| CVE-2013-0625⚡ exploited | critical | 9.8 | 94% | 2013 |
| CVE-2010-2861⚡ exploited | critical | 9.8 | 100% | 2010 |
| CVE-2023-26360⚡ exploited | high | 8.6 | 97% | 2023 |
| CVE-2023-38205⚡ exploited | high | 7.5 | 100% | 2023 |
| CVE-2023-29298⚡ exploited | high | 7.5 | 100% | 2023 |
| CVE-2013-0631⚡ exploited | high | 7.5 | 66% | 2013 |
| CVE-2013-0629⚡ exploited | high | 7.5 | 66% | 2013 |
| CVE-2024-20767⚡ exploited | high | 7.4 | 99% | 2024 |
| CVE-2009-3960⚡ exploited | medium | 6.5 | 90% | 2010 |
| CVE-2026-106624 | critical | 10 | 1% | 2026 |
| CVE-2026-106622 | critical | 10 | 1% | 2026 |
| CVE-2026-105899 | critical | 10 | 1% | 2026 |
| CVE-2026-48362 | critical | 10 | 4% | 2026 |
| CVE-2026-48316 | critical | 10 | 1% | 2026 |
| CVE-2026-48283 | critical | 10 | 1% | 2026 |
| CVE-2026-48281 | critical | 10 | 1% | 2026 |
| CVE-2026-48277 | critical | 10 | 1% | 2026 |
| CVE-2026-48276 | critical | 10 | 1% | 2026 |
| CVE-2025-54261 | critical | 10 | 25% | 2025 |
| CVE-2026-106612 | critical | 9.9 | 1% | 2026 |
| CVE-2026-105903 | critical | 9.9 | 1% | 2026 |
| CVE-2026-48273 | critical | 9.9 | 1% | 2026 |
| CVE-2026-48322 | critical | 9.9 | 1% | 2026 |
| CVE-2026-48318 | critical | 9.9 | 1% | 2026 |
| CVE-2024-41874 | critical | 9.8 | 30% | 2024 |
| CVE-2023-44353 | critical | 9.8 | 80% | 2023 |
| CVE-2023-44351 | critical | 9.8 | 50% | 2023 |
| CVE-2023-44350 | critical | 9.8 | 65% | 2023 |
| CVE-2023-38204 | critical | 9.8 | 67% | 2023 |
| CVE-2022-38418 | critical | 9.8 | 80% | 2022 |
| CVE-2022-35712 | critical | 9.8 | 37% | 2022 |
| CVE-2022-35711 | critical | 9.8 | 74% | 2022 |
| CVE-2022-35710 | critical | 9.8 | 43% | 2022 |
| CVE-2022-35690 | critical | 9.8 | 73% | 2022 |
| CVE-2020-3794 | critical | 9.8 | 7% | 2020 |
| CVE-2019-8256 | critical | 9.8 | 4% | 2019 |
| CVE-2019-8074 | critical | 9.8 | 19% | 2019 |
| CVE-2019-8073 | critical | 9.8 | 8% | 2019 |
| CVE-2019-7840 | critical | 9.8 | 17% | 2019 |
| CVE-2019-7839 | critical | 9.8 | 44% | 2019 |
| CVE-2019-7838 | critical | 9.8 | 17% | 2019 |
| CVE-2019-7091 | critical | 9.8 | 26% | 2019 |
| CVE-2019-7816 | critical | 9.8 | 68% | 2019 |
| CVE-2018-15965 | critical | 9.8 | 26% | 2018 |
| CVE-2018-15959 | critical | 9.8 | 26% | 2018 |
| CVE-2018-15958 | critical | 9.8 | 26% | 2018 |
| CVE-2018-15957 | critical | 9.8 | 28% | 2018 |
| CVE-2017-11284 | critical | 9.8 | 43% | 2017 |
| CVE-2017-11283 | critical | 9.8 | 43% | 2017 |
| CVE-2016-1114 | critical | 9.8 | 9% | 2016 |
| CVE-2026-75994 | critical | 9.6 | 0% | 2026 |
| CVE-2026-106620 | critical | 9.6 | 0% | 2026 |
| CVE-2026-71384 | critical | 9.6 | 0% | 2026 |
| CVE-2026-48284 | critical | 9.6 | 0% | 2026 |
| CVE-2026-47928 | critical | 9.6 | 2% | 2026 |
| CVE-2026-48325 | critical | 9.3 | 1% | 2026 |
| CVE-2026-48321 | critical | 9.3 | 0% | 2026 |
| CVE-2026-48315 | critical | 9.3 | 1% | 2026 |
| CVE-2026-48313 | critical | 9.3 | 3% | 2026 |
| CVE-2026-27304 | critical | 9.3 | 4% | 2026 |
| CVE-2025-49535 | critical | 9.3 | 1% | 2025 |
| CVE-2026-106621 | critical | 9.1 | 1% | 2026 |
| CVE-2026-75746 | critical | 9.1 | 1% | 2026 |
| CVE-2026-48324 | critical | 9.1 | 1% | 2026 |
| CVE-2026-48319 | critical | 9.1 | 1% | 2026 |
| CVE-2025-61811 | critical | 9.1 | 1% | 2025 |
| CVE-2025-61809 | critical | 9.1 | 1% | 2025 |
| CVE-2025-61808 | critical | 9.1 | 11% | 2025 |
| CVE-2025-43564 | critical | 9.1 | 17% | 2025 |
| CVE-2025-43563 | critical | 9.1 | 17% | 2025 |
| CVE-2025-43562 | critical | 9.1 | 51% | 2025 |
| CVE-2025-43561 | critical | 9.1 | 24% | 2025 |
216 older / lower-severity CVEs not shown — see ColdFusion's full record.
Is my ColdFusion version affected?
The list above spans every release. To know whether your version is affected — and the minimum safe version to upgrade to — check it directly.
Check your ColdFusion version → · Monitor ColdFusion for new CVEs →
ColdFusion vulnerabilities — frequently asked
How many known vulnerabilities does ColdFusion have?
IsItPatched tracks 296 CVEs for ColdFusion, 17 of which are actively exploited (CISA KEV). 81 are critical-severity and 110 high-severity. These span every release line — what matters is whether the version you run is affected.
Does ColdFusion have any actively-exploited vulnerabilities?
Yes — 17 ColdFusion CVEs are in CISA's Known Exploited Vulnerabilities catalog, meaning they are confirmed exploited in the wild (4 linked to ransomware). Patch these as a priority.
What is the most severe ColdFusion vulnerability?
Among tracked issues, CVE-2026-48282 (CRITICAL, CVSS 10), which is actively exploited, ranks highest — a Path traversal weakness.
Is ColdFusion safe to use?
It depends on the version. The latest supported ColdFusion release (2025.0.14.332029) clears the known issues; older versions may still be affected. Check the exact version you run for a verdict.
CVE data aggregated from NVD, CISA KEV and EPSS (FIRST.org). Related: ColdFusion security status · ColdFusion end-of-life · actively-exploited CVEs. Always verify against Adobe's advisories — see our disclaimer.