CVE-2023-29300Vulnerability

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on 8 Jan 2024.

Reported by 1 independent source · first reported 29 Jun 2026 by Huntress · last reported 29 Jun 2026

Last reported 3 months ago

CISA KEVAdded 8 Jan 2024
Fix due 29 Jan 2024
Used by ransomware: knownCISA KEV catalogue

EPSS100.0%
higher than 99% of CVEsFIRST EPSS, as of 27 Sep 2026

What the reports say

1 report, newest first · the exact sentence from each

“…itical remote code execution vulnerability (CVE-2023-26360), improper access control bug (CVE-2023-29298), and deserialization flaw (CVE-2023-29300).”

HuntressVendor29 Jun 2026
Defence Impairment Olympics

Indicators reported together

named in the same reports

g[.]comin 1 report
hs[.]comin 1 report
dump[.]comin 1 report
bd74a00f4d2ec3bf…e2f77943a920in 1 report
40859ede26209808…b166179980c6in 1 report
f63d293e117cae1d…b09268c8c39cin 1 report
94cd18f3f030fcc9…87bb9443b593in 1 report
793768ce4fadab04…19f32d56d0f3in 1 report
f0ff36ecdc843351…89181ebdb57fin 1 report

Copy these 9 indicators · defanged

9 indicators, defanged, one per line

g[.]com
hs[.]com
dump[.]com
bd74a00f4d2ec3bf50d13ddf324bb368b2464d547abd0c572ef5e2f77943a920
40859ede262098086962ab00c89f02452aa9941c88c7f4ac002db166179980c6
f63d293e117cae1d0a6c24359fc1361a9dc48178049cc6491051b09268c8c39c
94cd18f3f030fcc9b259dc410b17ea72a1f9800ee654f8e0f07a87bb9443b593
793768ce4fadab044c7502ea5ec4d8e1569283f289dfd73419e119f32d56d0f3
f0ff36ecdc843351913dbfbd9122b62563894936ff64215a7a2f89181ebdb57f

Also named with it: CVE-2023-26360, CVE-2023-29298

Thanks — we review every report.

Report a wrong value