EXPOSURES › CVE-2013-0631
CVE-2013-0631
HIGH ⌖ ON CISA KEV · EXPLOITEDAdobe ColdFusion suffered from critical unpatched command injection and eval injection flaws enabling remote code execution and privilege escalation.
ColdFusion's legacy architecture and delayed patching allowed attackers to exploit CVSS 10.0 command injection and eval injection flaws, leading to arbitrary code execution and privilege escalation. DIB organizations must prioritize patching legacy platforms and monitor for supply-chain compromises, as these flaws were actively exploited in the wild before Adobe released fixes in 2025.0.12 and 2023.0.23.
Shame score — Adobe shipped a legacy platform with known critical RCE flaws that remained unpatched for years, allowing widespread exploitation before fixes were deployed.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.
"Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server."
| PRODUCT | STATUS |
|---|---|
| Adobe Acrobat Sign for Government Adobe |
Authorized |
| Adobe Analytics Adobe |
Authorized |
| Adobe Campaign Adobe |
Authorized |
| Adobe Connect Managed Services (ACMS-GC) Adobe |
Authorized |
| Adobe Creative Cloud for Enterprise Adobe |
Authorized |
| Adobe Document Cloud (PDF Services & Adobe Sign) Adobe |
Authorized |
| Adobe Experience Manager Managed Services (AEMMS-GC) Adobe |
Authorized |
| Adobe Learning Manager Adobe |
Authorized |