Two (2) critical vulnerabilities in Adobe’s ColdFusion product have been added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog, mandating that all Federal Civilian Executive Branch (FCEB) agencies patch the flaws no later than August 10, 2023. ColdFusion, a high-performance application server for developing and deploying web applications, is a rapid scripting environment for creating dynamic internet applications using the ColdFusion Markup Language (CFML). The first vulnerability, tracked as CVE-2023-29298, is an improper access control flaw allowing unauthenticated threat actors to bypass security and access the ColdFusion Markup (CFM) and ColdFusion Component (CFC) endpoints with no need for victim interaction. After Adobe patched CVE-2023-29298, researchers stated that they had identified a trivial workaround of the patch (now tracked as CVE-2023-38205), allowing the attackers to bypass security and achieve the same goal. These vulnerabilities were chained with two (2) deserialization of untrusted data flaws tracked as CVE-2023-29300/CVE-2023-38203 to conduct remote code execution (RCE), installing webshells on vulnerable ColdFusion servers to gain backdoor remote access to infrastructure. These vulnerabilities are being actively exploited in-the-wild, and CTIX analysts urge all ColdFusion developers and administrators to become compliant in installing the patched version of the software immediately.