How severe is CVE-2018-15961?

CVE-2018-15961 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 100.0% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2018-15961: Adobe ColdFusion Unrestricted File Upload

CISA Known Exploited Vulnerabilities

Adobe ColdFusion Unrestricted File Upload Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2021-11-03

Remediation due

2022-05-03

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2018-15961

Description

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.

Severity

CVSS 3.1 · CISA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
Adobe	ColdFusion	July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions

References

4 Links

Exploits & PoCs

45979

Vulnerability databases

Other references

https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html

Record Details

Published

2018-09-25

Last updated

2025-10-21

Assigner (CNA)

adobe

Credited to

More from Adobe

CVE-2024-341029.8

XXE can expose crypt key and other secrets granting full admin access

CVE-2023-293009.8

Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

CVE-2023-292987.5

Adobe ColdFusion Improper Access Control Security feature bypass

CVE-2023-382057.5

ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.