Increased Cyberattacks Target Adobe ColdFusion and Oracle Agile PLM

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding ongoing cyberattacks exploiting vulnerabilities in Adobe ColdFusion and Oracle Agile Product Lifecycle Management (PLM) systems.

CISA's alert highlights several security flaws, some of which are longstanding, that attackers are currently leveraging. One significant issue identified in Adobe ColdFusion involves the Apache BlazeDS library, where a critical Java deserialization vulnerability (CVE-2017-3066) has been identified. Although Adobe has issued a hotfix for this vulnerability back in April 2017 for versions 10, 11, and 2016, the agency has noted that no further details or a Common Vulnerability Scoring System (CVSS) rating have been provided by Adobe.

On the other hand, the vulnerability affecting Oracle Agile PLM has been known for over a year now. CISA describes this particular flaw as a deserialization vulnerability that can be exploited remotely. Attackers can gain full control over an Oracle Agile PLM instance (CVE-2024-20953) with just HTTP access and minimal permissions, resulting in a high-risk scenario with a CVSS score of 8.8.

While CISA has not elaborated on the specifics of how these attacks are being conducted or the extent of their impact, it emphasizes the urgency for IT administrators to implement the necessary updates without delay.

The warning comes on the heels of recent alerts from CISA regarding ongoing attacks against other platforms, including Palo Alto Networks' PAN-OS and Craft CMS. The vulnerabilities in these systems were notably newer, suggesting a critical need for administrators to stay vigilant and apply updates promptly to safeguard networks against potential breaches.

In light of these developments, organizations utilizing Adobe ColdFusion and Oracle Agile PLM are strongly encouraged to review their systems for the mentioned vulnerabilities and apply the necessary patches as soon as possible to mitigate potential threats.