critical9.8Known exploitedPublic exploit code
CVE-2017-3066
Adobe ColdFusion Deserialization Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-02-24. Federal due date: 2025-03-17.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Adobe Coldfusion 11.0.03.292866 - BlazeDS Java Object Deserialization Remote Code Execution2018-02-07 · remote · windows
Impact
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adobe | Coldfusion | Versions 10.0, 11.0, 2016 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://www.securityfocus.com/bid/98003
- http://www.securitytracker.com/id/1038364
- https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html
- https://www.exploit-db.com/exploits/43993/
- http://www.securityfocus.com/bid/98003
- http://www.securitytracker.com/id/1038364
- https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html
- https://www.exploit-db.com/exploits/43993/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3066