Active Exploitation of Newly Patched Cold Fusion Vulnerability (CVE-2018-15961)

Summary: Volexity observed a suspected Chinese APT group exploiting CVE-2018-15961, an unauthenticated file upload vulnerability in Adobe ColdFusion patched on September 11, 2018, by uploading a China Chopper webshell to a server missing that single update. The flaw, introduced when Adobe replaced FCKeditor with CKEditor, allowed a simple HTTP POST to upload.cfm, and the attackers used it because Adobe's default block list omitted the .jsp extension that ColdFusion executes.
Bottom line: Exploitation came roughly two weeks after the patch, and Volexity's scan of internet-facing ColdFusion servers found numerous compromised systems across educational institutions, state government, health research, and humanitarian aid organizations, with files dated June 2 and June 6, 2018 suggesting a non-APT actor may have found the flaw before Adobe published it.

Read the original at Volexity Blog ↗

Topics: Detection & Response
Mentions: CVE-2018-15961
Related: CVE-2018-15961: Adobe Cold Fusion Unrestricted File Upload Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026