Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
At a glance
Severity
CRITICAL 9.8
Exploitation
Known exploited (CISA KEV) · added 2023-08-21 Exploited per ENISA since 2023-08-21
EPSS
EPSS 16.99 % · percentile 97 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
adobe
NVD status
Analyzed
Description
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
