---
title: "ColdFusion CVE-2024-20767: Exploited PMS File Read"
url: https://erroneo.us/security/briefs/adobe-coldfusion-cve-2024-20767-pms-file-read/
description: "Unauthenticated file read in ColdFusion 2023 Update 6, 2021 Update 12 and earlier, in KEV since Dec 2024 with public exploits. Check builds and admin exposure."
type: security-brief
section: "Security Digest"
date_published: 2024-03-12
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-20767"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# ColdFusion CVE-2024-20767: Exploited PMS File Read

**Verdict: Check exposure.** Fixed since March 2024 and still probed in 2026; any ColdFusion server with reachable admin endpoints on an old build should be upgraded and treated as having leaked its files, and being past this CVE alone is not enough.

- **Who must act:** Owners of ColdFusion 2023 or 2021 servers below the fixed updates whose /CFIDE/adminapi/ or /pms paths are reachable from the internet, and anyone still running ColdFusion 2021 or 2018.
- **Who can relax:** Teams on a current ColdFusion 2025 or 2023 update that block administrator paths from the internet, and organizations that do not run ColdFusion.
- **Affected:** ColdFusion 2023 Update 6 and earlier; ColdFusion 2021 Update 12 and earlier; Exploitation requires the admin endpoints to be reachable, per Adobe
- **Fixed:** ColdFusion 2023 Update 7 and 2021 Update 13 (March 12, 2024); Adobe's revised bulletin now names 2023 Update 12 and 2021 Update 18 (APSB24-107); For later KEV bugs, current servers need ColdFusion 2025 Update 10 or 2023 Update 21 or later; ColdFusion 2021 left core support on November 10, 2025 and gets no security patches
- **CVEs:** CVE-2024-20767
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every ColdFusion server, including internal and staging boxes, and record its version and update level.
2. Upgrade to a current ColdFusion 2025 or 2023 update; 2025 Update 10 or 2023 Update 21 is the floor because of CVE-2026-48282.
3. Migrate ColdFusion 2021 and 2018 servers, which no longer receive security fixes.
4. Block /CFIDE/adminapi/, /CFIDE/administrator/ and /pms from the internet at the proxy or WAF, apply Adobe's lockdown guide, and update the JDK.
5. If a reachable server ran a vulnerable build after March 2024, assume its files were read and rotate the datasource, admin and API credentials it stores.

### How to check if you are affected

- Search web logs for GET requests to /CFIDE/adminapi/_servermanager/servermanager.cfc with method=getHeartBeat from outside your network.
- Search for requests to /pms with module=logging and a file_name parameter containing ../ sequences.
- After any hit, look for follow-on activity: new admin logins, unknown .cfm or .jsp files under the web root, and use of credentials stored on the server.

## What happened

On March 12, 2024, Adobe bulletin [APSB24-14](http://web.archive.org/web/20250607003212/https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html) fixed CVE-2024-20767, an improper access control flaw (CWE-284) that allows arbitrary file system reads. It affects ColdFusion 2023 Update 6 and 2021 Update 12 and earlier. The researcher ma4ter reported it. The first fixes were 2023 Update 7 and 2021 Update 13. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-20767) says exploitation needs no user interaction but "requires the admin panel be exposed to the internet."

The [Metasploit module](https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/coldfusion_pms_servlet_file_read.rb) shows how simple the attack is. An unauthenticated request to `/CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat` returns a UUID. Sent back in a `uuid` header to `/pms?module=logging&file_name=../../...`, that UUID lets the attacker read any file the service can. Technical details and a proof of concept followed soon after the patch, and a public exploit by [yoryio](https://github.com/yoryio/CVE-2024-20767) is on GitHub. Adobe's bulletin acknowledges a known proof of concept.

CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20767) on December 16, 2024, with a January 6, 2025 deadline. [SecurityWeek](https://www.securityweek.com/cisa-warns-of-exploited-adobe-coldfusion-windows-vulnerabilities/) found no earlier public reports of exploitation, and CISA shared no details. A week later, on December 23, Adobe raised the bulletin to Priority 1. It now says the bug was "further addressed" in 2023 Update 12 and 2021 Update 18, released with [APSB24-107](http://web.archive.org/web/20260516094348/https://helpx.adobe.com/security/products/coldfusion/apsb24-107.html). That bulletin fixed CVE-2024-53961, another file-read bug from ma4ter with a known proof of concept. The revised APSB24-14 scores CVE-2024-20767 at CVSS 3.1 8.2. The CVE record and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-20767) still show 7.4.

Attacks have not stopped. [CrowdSec](https://www.crowdsec.net/vulntracking-report/cve-2024-20767) reports exploitation since about the KEV listing. It sees a baseline of roughly 15 IPs a day, and a surge to more than 100 machines on January 4, 2026, mostly from DigitalOcean.

## Who is affected

ColdFusion 2023 Update 6 and earlier and 2021 Update 12 and earlier, where the admin endpoints are reachable. For full coverage, Adobe now points to 2023 Update 12 and 2021 Update 18. ColdFusion 2021 left core support on November 10, 2025. Adobe says its extended support [does not include security patches](https://coldfusion.adobe.com/2025/04/planning-ahead-coldfusion-2021-support-ending-soon/).

## Do you really need to act?

Only if you run ColdFusion, but then check carefully. A file read sounds mild, yet the attacker can pull configuration and credentials from the server. Being past this CVE is also not enough. CISA has since added CVE-2017-3066 (February 2025) and [CVE-2026-48282](https://www.cve.org/CVERecord?id=CVE-2026-48282) (July 2026), an RDS path traversal that leads to code execution. That bug needs ColdFusion 2025 Update 10 or 2023 Update 21. A 2021 server cannot get that fix.

## What to do now

1. Inventory every ColdFusion server and record its update level.
2. Upgrade to a current 2025 or 2023 update, and update the JDK as Adobe's bulletins require.
3. Migrate 2021 and 2018 servers.
4. Block `/CFIDE/adminapi/`, `/CFIDE/administrator/` and `/pms` from the internet. From outside, `curl -s 'https://your-host/CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat'` should not return a UUID.
5. If a reachable server ran a vulnerable build after March 2024, rotate the credentials it stores.

## How to tell if you were hit

Search web logs for `getHeartBeat` calls to `servermanager.cfc` from outside, and for `/pms` requests with `module=logging` and `../` in `file_name`. The module notes that the attack leaves traces in logs. After any hit, look for new admin logins, unknown `.cfm` files and misuse of stored credentials.

## Timeline

- Mar 12, 2024 — Adobe releases APSB24-14 (2023 Update 7, 2021 Update 13).
- Mar 18, 2024 — The CVE is published.
- Dec 16, 2024 — CISA adds the CVE to KEV.
- Dec 23, 2024 — Adobe revises APSB24-14 to Priority 1 and releases APSB24-107.
- Jan 6, 2025 — KEV remediation deadline.
- Nov 10, 2025 — ColdFusion 2021 core support ends.
- Jan 4, 2026 — CrowdSec sees an exploitation surge.

## Sources

1. [Adobe — APSB24-14: Security updates available for Adobe ColdFusion (archived Jun 2025)](http://web.archive.org/web/20250607003212/https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html)
2. [Adobe — APSB24-107: Security updates available for Adobe ColdFusion (archived)](http://web.archive.org/web/20260516094348/https://helpx.adobe.com/security/products/coldfusion/apsb24-107.html)
3. [CVE record — CVE-2024-20767](https://www.cve.org/CVERecord?id=CVE-2024-20767)
4. [NVD — CVE-2024-20767](https://nvd.nist.gov/vuln/detail/CVE-2024-20767)
5. [CISA — Known Exploited Vulnerabilities: CVE-2024-20767](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20767)
6. [Rapid7 Metasploit — CVE-2024-20767 Adobe Coldfusion Arbitrary File Read module](https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/coldfusion_pms_servlet_file_read.rb)
7. [yoryio — Exploit for CVE-2024-20767 (GitHub)](https://github.com/yoryio/CVE-2024-20767)
8. [CrowdSec — CVE-2024-20767 Exploited in the Wild: Adobe ColdFusion Under Attack](https://www.crowdsec.net/vulntracking-report/cve-2024-20767)
9. [CVE record — CVE-2026-48282](https://www.cve.org/CVERecord?id=CVE-2026-48282)
10. [Adobe ColdFusion blog — Planning Ahead: ColdFusion 2021 Support Ending Soon](https://coldfusion.adobe.com/2025/04/planning-ahead-coldfusion-2021-support-ending-soon/)
11. [SecurityWeek — CISA Warns of Exploited Adobe ColdFusion, Windows Vulnerabilities](https://www.securityweek.com/cisa-warns-of-exploited-adobe-coldfusion-windows-vulnerabilities/)

---
Source page: https://erroneo.us/security/briefs/adobe-coldfusion-cve-2024-20767-pms-file-read/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt