Adobe ColdFusion: Deserialization RCE (CVE-2023-26360)

An internet-facing Adobe ColdFusion 2021 server is exploited via CVE-2023-26360 -- an unauthenticated deserialization vulnerability in the ColdFusion IDE endpoint that bypasses access controls. The attacker reads credential files from WEB-INF, then drops a CFM webshell and uses it to enumerate the host, recover configuration data, and exfiltrate harvested material to an external staging domain. The ColdFusion service account is then used to authenticate laterally to an internal HR data server via SMB. Piece together the intrusion from the ColdFusion web logs, the Windows process and authentication events, and the perimeter firewall records.