ColdFusion CVE-2024-20767: Exploited PMS File Read

What to do

1. Inventory every ColdFusion server, including internal and staging boxes, and record its version and update level.
2. Upgrade to a current ColdFusion 2025 or 2023 update; 2025 Update 10 or 2023 Update 21 is the floor because of CVE-2026-48282.
3. Migrate ColdFusion 2021 and 2018 servers, which no longer receive security fixes.
4. Block /CFIDE/adminapi/, /CFIDE/administrator/ and /pms from the internet at the proxy or WAF, apply Adobe's lockdown guide, and update the JDK.
5. If a reachable server ran a vulnerable build after March 2024, assume its files were read and rotate the datasource, admin and API credentials it stores.

How to check if you are affected or compromised

• Search web logs for GET requests to /CFIDE/adminapi/_servermanager/servermanager.cfc with method=getHeartBeat from outside your network.
• Search for requests to /pms with module=logging and a file_name parameter containing ../ sequences.
• After any hit, look for follow-on activity: new admin logins, unknown .cfm or .jsp files under the web root, and use of credentials stored on the server.

What happened#

On March 12, 2024, Adobe bulletin APSB24-14 fixed CVE-2024-20767, an improper access control flaw (CWE-284) that allows arbitrary file system reads. It affects ColdFusion 2023 Update 6 and 2021 Update 12 and earlier. The researcher ma4ter reported it. The first fixes were 2023 Update 7 and 2021 Update 13. The CVE record says exploitation needs no user interaction but "requires the admin panel be exposed to the internet."

The Metasploit module shows how simple the attack is. An unauthenticated request to /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat returns a UUID. Sent back in a uuid header to /pms?module=logging&file_name=../../..., that UUID lets the attacker read any file the service can. Technical details and a proof of concept followed soon after the patch, and a public exploit by yoryio is on GitHub. Adobe's bulletin acknowledges a known proof of concept.

CISA added the CVE to the KEV catalog on December 16, 2024, with a January 6, 2025 deadline. SecurityWeek found no earlier public reports of exploitation, and CISA shared no details. A week later, on December 23, Adobe raised the bulletin to Priority 1. It now says the bug was "further addressed" in 2023 Update 12 and 2021 Update 18, released with APSB24-107. That bulletin fixed CVE-2024-53961, another file-read bug from ma4ter with a known proof of concept. The revised APSB24-14 scores CVE-2024-20767 at CVSS 3.1 8.2. The CVE record and NVD still show 7.4.

Attacks have not stopped. CrowdSec reports exploitation since about the KEV listing. It sees a baseline of roughly 15 IPs a day, and a surge to more than 100 machines on January 4, 2026, mostly from DigitalOcean.

Who is affected#

ColdFusion 2023 Update 6 and earlier and 2021 Update 12 and earlier, where the admin endpoints are reachable. For full coverage, Adobe now points to 2023 Update 12 and 2021 Update 18. ColdFusion 2021 left core support on November 10, 2025. Adobe says its extended support does not include security patches.

Do you really need to act?#

Only if you run ColdFusion, but then check carefully. A file read sounds mild, yet the attacker can pull configuration and credentials from the server. Being past this CVE is also not enough. CISA has since added CVE-2017-3066 (February 2025) and CVE-2026-48282 (July 2026), an RDS path traversal that leads to code execution. That bug needs ColdFusion 2025 Update 10 or 2023 Update 21. A 2021 server cannot get that fix.

What to do now#

1. Inventory every ColdFusion server and record its update level.
2. Upgrade to a current 2025 or 2023 update, and update the JDK as Adobe's bulletins require.
3. Migrate 2021 and 2018 servers.
4. Block /CFIDE/adminapi/, /CFIDE/administrator/ and /pms from the internet. From outside, curl -s 'https://your-host/CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat' should not return a UUID.
5. If a reachable server ran a vulnerable build after March 2024, rotate the credentials it stores.

How to tell if you were hit#

Search web logs for getHeartBeat calls to servermanager.cfc from outside, and for /pms requests with module=logging and ../ in file_name. The module notes that the attack leaves traces in logs. After any hit, look for new admin logins, unknown .cfm files and misuse of stored credentials.

Timeline#

• Mar 12, 2024 — Adobe releases APSB24-14 (2023 Update 7, 2021 Update 13).
• Mar 18, 2024 — The CVE is published.
• Dec 16, 2024 — CISA adds the CVE to KEV.
• Dec 23, 2024 — Adobe revises APSB24-14 to Priority 1 and releases APSB24-107.
• Jan 6, 2025 — KEV remediation deadline.
• Nov 10, 2025 — ColdFusion 2021 core support ends.
• Jan 4, 2026 — CrowdSec sees an exploitation surge.

Vulnerability records

• CVE-2024-20767 · KEV 2024-12-16 · ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Adobe — APSB24-14: Security updates available for Adobe ColdFusion (archived Jun 2025) web.archive.org
2. Adobe — APSB24-107: Security updates available for Adobe ColdFusion (archived) web.archive.org
3. CVE record — CVE-2024-20767 cve.org
4. NVD — CVE-2024-20767 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2024-20767 cisa.gov
6. Rapid7 Metasploit — CVE-2024-20767 Adobe Coldfusion Arbitrary File Read module github.com
7. yoryio — Exploit for CVE-2024-20767 (GitHub) github.com
8. CrowdSec — CVE-2024-20767 Exploited in the Wild: Adobe ColdFusion Under Attack crowdsec.net
9. CVE record — CVE-2026-48282 cve.org
10. Adobe ColdFusion blog — Planning Ahead: ColdFusion 2021 Support Ending Soon coldfusion.adobe.com

Coverage and analysis

1. SecurityWeek — CISA Warns of Exploited Adobe ColdFusion, Windows Vulnerabilities securityweek.com