How severe is CVE-2018-15961?

CVE-2018-15961 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 100.0% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2018-15961: Adobe ColdFusion Unrestricted File Upload

CISA Known Exploited Vulnerabilities

Adobe ColdFusion Unrestricted File Upload Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2021-11-03

Remediation due

2022-05-03

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2018-15961

Description

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.

Severity

CVSS 3.1 · CISA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Exploitation Context

as of October 14, 2026

All KEV statistics→

CISA added CVE-2018-15961 to the KEV catalog 1,135 days after its CVE record was published.
It is one of 82 Adobe entries in the CISA KEV catalog, and one of 5 added in 2021.
Its current EPSS score (100.0%) is higher than that of 94% of CISA KEV entries.

Affected Products

Vendor	Product	Affected versions
Adobe	Adobe ColdFusion	July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions

References

4 Links

Exploits & PoCs

45979

Vulnerability databases

Other references

https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html

Record Details

Published

2018-09-25

Last updated

2025-10-21

Assigner (CNA)

adobe

Credited to

More from Adobe

All Adobe CVEs→

CVE-2023-293009.8 CRITICAL

Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

AdobeKEVEPSS 100.0%2023-07-12

CVE-2023-292987.5 HIGH

Adobe ColdFusion Improper Access Control Security feature bypass

AdobeKEVEPSS 99.8%2023-07-12

CVE-2023-382057.5 HIGH

ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298

AdobeKEVEPSS 99.8%2023-09-14

CVE-2010-28617.5 HIGH

Adobe ColdFusion Directory Traversal Vulnerability

KEVEPSS 99.7%2010-08-11

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.