{"uuid": "098c4420-6681-49f6-b5a7-5dd35644848c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21087", "type": "seen", "source": "https://t.me/hacking_Attack/2176", "content": "Black Hat Ethical Hacking\nAdobe Fixes Critical ColdFusion Flaw in Emergency Update\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Adobe Fixes Critical ColdFusion Flaw in Emergency UpdatePost Views: 23 \nstyle=\"display:block\"\n data-ad-client=\"ca-pub-6620833063853657\"\n data-ad-slot=\"8337846400\"\n data-ad-format=\"auto\"\n data-full-width-responsive=\"true\"> \nReading Time: 1 Minute\nAttackers can leverage the critical Adobe ColdFusion flaw to launch arbitrary code execution attacks.\nIn an unscheduled security update, Adobe is warning of a critical security flaw in its ColdFusion platform, used for building web applications.\n\nThe security alert comes two weeks after Adobe\u2019s regularly-scheduled updates. During these updates, the tech company issued patches for a slew of critical security vulnerabilities, which, if exploited, could allow for arbitrary code execution on vulnerable Windows systems.\n\nThe latest flaw (CVE-2021-21087) exists in ColdFusion versions 2016 (Update 16 and earlier), 2018 (Update 10 and earlier) and 2021 (Version 2021.0.0.323925), and could lead to arbitrary code execution.\n\n\u201cAdobe is not aware of any exploits in the wild for any of the issues addressed in these updates,\u201d according to Adobe on Monday.\nSee Also: Bogus Android Clubhouse App Drops Credential-Swiping Malware The vulnerability stems from improper input validation, which is a type of issue (previously plaguing other Adobe products) that occurs when the affected product does not validate input. This can affect the control flow or data flow of a program, and allow for an attacker to launch a slew of malicious attacks. Further information on the flaw \u2013 including where in ColdFusion it exists, and how difficult it is to exploit, were not addressed; Threatpost has reached out to Adobe for further comment.\n\nThe flaw has been corrected in the following versions of ColdFusion: ColdFusion 2016 (update 17), ColdFusion 2018 (update 11) and ColdFusion 2021 (update 1). See below for the updated versions. https://media.threatpost.com/wp-content/uploads/sites/103/2021/03/22104629/adobe-coldfusion-1024x362.png Source: Adobe\nAdobe said the security update is a \u201cpriority 2,\u201d\u00a0meaning that it resolves vulnerabilities \u201cin a product that has historically been at elevated risk\u201d \u2013 but for which there are currently no known exploits.\nSee Also: Offensive Security Tool: Skipfish\n\u201cBased on previous experience, we do not anticipate exploits are imminent,\u201d for \u201cpriority 2\u201d updates, said Adobe. However, \u201cas a best practice, Adobe recommends administrators install the update soon (for example, within 30 days).\u201d\n\nAdobe credited Josh Lane with discovering and reporting the flaw.\n\nColdFusion, a web-programming language providing a platform for building and deploying web and mobile applications, has previously been privy to various security flaws. See Also: Hacking Stories: Albert Gonzalez & the \u2018Get Rich or Die Trying\u2019 Crew who stole 130 million credit-card numbersIn April, Adobe released patches for \u201cimportant\u201d-severity vulnerabilities\u00a0in ColdFusion, which if exploited, could enable attackers to view sensitive data, gain escalated privileges, and launch denial-of-service attacks. \u00a0And in 2019, Adobe issued unscheduled security updates to fix two critical flaws in its ColdFusion product. The critical vulnerabilities could have enabled an attacker to either execute arbitrary code or bypass access control on impacted systems.\nSource: https://threatpost.com (Click Link)style=\"display:block\"\n data-ad-client=\"ca-pub-6620833063853657\"\n data-ad-slot=\"8337846400\"\n data-ad-format=\"auto\"\n data-full-width-responsive=\"true\"> Recent News* https://www.blackhatethi[...]", "creation_timestamp": "2026-09-02T01:03:26.233351Z"}