Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)

Volexity observed a suspected Chinese APT actively exploiting Adobe ColdFusion vulnerability CVE-2018-15961 (unauthenticated file upload via CKEditor) to upload a JSP China Chopper webshell and execute commands on unpatched Internet-facing ColdFusion servers. The advisory describes how attackers bypassed file-type restrictions and path controls, documents multiple compromised sites (including defacements and attempted uploads), provides Suricata/Snort detection signatures, and recommends immediate patching, log review, and administrative access restrictions.