{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aadobecoldfusion2016/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:adobe:coldfusion:11.0:*:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2016:*:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2018-15961"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ColdFusion (11.0, 2016, 2018)"],"_cs_severities":["critical"],"_cs_tags":["adobe","coldfusion","rce","file-upload","cve-2018-15961"],"_cs_type":"advisory","_cs_vendors":["Adobe"],"content_html":"\u003cp\u003eCVE-2018-15961 is a critical security vulnerability affecting Adobe ColdFusion versions 11.0, 2016, and 2018. The flaw resides in the CKEditor component, specifically within the \u003ccode\u003eupload.cfm\u003c/code\u003e file used for file management. Because the application fails to adequately validate or restrict the types of files being uploaded, an unauthenticated attacker can upload arbitrary files, including JSP shells, to the server. By navigating to the location of the uploaded file, the attacker can execute arbitrary code within the context of the ColdFusion service. The availability of multiple public exploits, including modules in Metasploit, increases the risk of exploitation. Defenders should verify that all Adobe ColdFusion instances have been updated according to Adobe Security Bulletin APSB18-33.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify internet-facing Adobe ColdFusion servers.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a multipart/form-data POST request targeting \u003ccode\u003e/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker includes a malicious payload (e.g., a JSP web shell) in the \u003ccode\u003efile\u003c/code\u003e form-data parameter.\u003c/li\u003e\n\u003cli\u003eAttacker provides a path argument in the \u003ccode\u003epath\u003c/code\u003e form-data parameter to define the destination of the uploaded file.\u003c/li\u003e\n\u003cli\u003eThe server processes the request and saves the file to the web-accessible directory \u003ccode\u003e.../cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP GET request to the path where the file was saved to trigger the execution of the embedded JSP code.\u003c/li\u003e\n\u003cli\u003eAttacker gains remote code execution on the underlying server to facilitate further malicious activity.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution on the target server. This allows an attacker to gain unauthorized access to sensitive data, establish persistence, pivot within the internal network, or deploy additional malware. The vulnerability has a CVSS score of 10.0, reflecting its severity, and has been subject to multiple public exploit releases over several years.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all Adobe ColdFusion instances to the versions specified in Adobe Security Bulletin APSB18-33.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) rule to block POST requests directed at \u003ccode\u003e/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm\u003c/code\u003e unless specifically required by business needs.\u003c/li\u003e\n\u003cli\u003eScan the directory \u003ccode\u003e.../cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/\u003c/code\u003e for unrecognized JSP or executable files.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided below to monitor for exploitation attempts targeting the vulnerable endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T01:10:01Z","date_published":"2026-10-21T01:10:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2018-15961/","summary":"An unrestricted file upload vulnerability in the Adobe ColdFusion CKEditor component allows unauthenticated attackers to achieve remote code execution by uploading malicious JSP files.","title":"Adobe ColdFusion: Unrestricted file upload via CKEditor (CVE-2018-15961)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2018-15961/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:adobe:coldfusion:2016:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}