The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has notified that a known critical vulnerability in Adobe ColdFusion that was patched in March 2023 is still under active exploitation by threat actors attempting to gain access and control over government servers. Adobe ColdFusion is an application server and rapid scripting environment for developing and deploying web applications using ColdFusion Markup Language (CFML). The flaw, tracked as CVE-2023-26360, is an improper access control vulnerability which, if exploited, could allow threat actors to execute arbitrary code in the target environment. When the vulnerability was originally exploited as a zero-day in March, CISA did not disclose the name of the affected entity. In the December 2023 alert, America’s Cyber Defense Agency warned that the flaw was being continuously exploited, and that in June 2023, the vulnerability led to the compromise of at least two (2) public-facing servers after threat actors successfully dropped malware payloads via “HTTP POST commands to the directory path associated with ColdFusion.” Once they had gained access to the servers, threat actors attempted exfiltrating registry files as well as security account manager (SAM) information. Although the threat actors were able to gain access, the malicious activity was detected and blocked before they could exfiltrate data or move laterally across the network. This flaw was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog when it was originally exploited in March, meaning all Federal Civilian Executive Branch (FCEB) agencies are required to patch the bug. CTIX analysts recommend that any administrators responsible for Adobe ColdFusion servers patch this vulnerability immediately to prevent being compromised.