CVE Watch—

CVE-2024-20767

Adobe ColdFusion Improper Access Control Vulnerability

CVSS

—

No CVSS

EPSS

98.5%

p100

KEV

YES

Dec 16, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

98.5%EPSS · 30 days98.5%

2026-08-022026-08-30

KEV catalog record

Product

Adobe / ColdFusion

Vulnerability

Adobe ColdFusion Improper Access Control Vulnerability

Added to KEV

Dec 16, 2024

Remediate by

Jan 6, 2025

Known ransomware use

Summary description

Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-20767

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-4828210.0 CRI

98.6%

KEV—80Adobe ColdFusion Path Traversal Vulnerability3d CVE-2010-28619.8 CRI

100.0%

KEV—80Adobe ColdFusion Directory Traversal Vulnerability17d CVE-2023-29300—

100.0%

KEV—80Adobe ColdFusion Deserialization of Untrusted Data Vulnerability—CVE-2023-29298—

100.0%

KEV—80Adobe ColdFusion Improper Access Control Vulnerability—CVE-2023-38205—

100.0%

KEV—80Adobe ColdFusion Improper Access Control Vulnerability—CVE-2018-15961—

100.0%

KEV—80Adobe ColdFusion Unrestricted File Upload Vulnerability—