CISA Orders U.S. Federal Agencies to Fix Critical Adobe ColdFusion Flaw by Friday

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal government agencies to fix a maximum-severity vulnerability in Adobe ColdFusion, a commercial web application development platform.

Under the directive, the issue must be resolved by Friday. The requirement applies to all agencies of the U.S. federal government.

Active exploitation

According to CISA, the vulnerability is already being actively exploited by attackers in real-world attacks. It is precisely this circumstance that led to the flaw being added to the Known Exploited Vulnerabilities (KEV) catalog and to the strict remediation deadline being set.

The Adobe ColdFusion platform is traditionally used by organizations to build and deploy web applications and websites. Vulnerabilities in software of this kind pose an elevated risk, as they can give attackers access to agencies' internal systems and data.

What the agencies must do

CISA's Binding Operational Directives, which require the remediation of vulnerabilities, apply exclusively to U.S. federal executive branch agencies; however, the agency traditionally also recommends that private organizations using the vulnerable software install the relevant security updates as soon as possible.

No details have been disclosed so far regarding the specific attack vectors, the scale of exploitation, or the number of affected organizations.

Source: Bleeping Computer