Critical Warning from the US Cybersecurity Agency: Vulnerabilities in Adobe ColdFusion and Oracle Agile PLM Are Being Exploited!

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an announcement that has put the cybersecurity world on alert. The agency added two critical security vulnerabilities in Adobe ColdFusion and Oracle Agile Product Lifecycle Management (PLM) products to its “Known Exploited Vulnerabilities (KEV)” catalog. This decision is based on evidence that these vulnerabilities are being actively exploited.

Which Security Vulnerabilities Are Posing a Threat?

The security vulnerabilities that CISA warned about and that have been identified as actively exploited by cyber attackers are:

• CVE-2017-3066 (CVSS Score: 9.8) – Deserialization Vulnerability in Adobe ColdFusion: This critical vulnerability allows attackers to execute code remotely. The high CVSS score of 9.8 clearly shows how dangerous this flaw is.

What Do These Vulnerabilities Mean?

These security vulnerabilities could potentially lead to the theft of sensitive data from companies and users, the takeover of their systems, and even exposure to ransomware attacks. This poses a serious risk, especially for organizations managing critical infrastructure and businesses using this software.

Urgent Call to Action from CISA

CISA instructed federal civilian executive branch agencies to patch these vulnerabilities within 3 weeks, by May 17, 2024. However, this warning applies not only to government agencies but to all organizations using Adobe ColdFusion and Oracle Agile PLM. CISA is calling on all users to patch these vulnerabilities as soon as possible and secure their systems.

How Can You Protect Yourself?

You can protect your systems against these security vulnerabilities by following the steps below:

1. Keep Your Software Up to Date: Use the latest versions of your Adobe ColdFusion and Oracle Agile PLM software. Regularly install the security updates released by software vendors.
2. Perform Security Scans: Identify possible weaknesses by performing vulnerability scans on your systems.
3. Validate Inputs: Prevent deserialization vulnerabilities by strictly validating user inputs and data.
4. Use Firewalls and Monitoring Systems: Use firewalls and monitoring systems to protect your systems from malicious traffic.
5. Train Your Employees: Raise awareness against possible attacks by training your employees on cybersecurity.

Remember: Cybersecurity Is an Ongoing Process!

Cybersecurity is not a one-time task but an ongoing process. By regularly updating your systems and improving security, you can become more resilient against cyber attacks.

Additional Information: CISA’s KEV catalog contains a list of actively exploited vulnerabilities and guides organizations to focus on the flaws that need to be patched as a priority.