Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2018-4939 · Published 19/05/2018 · updated 17/06/2026

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
coldfusion adobe	`= 11.0= 2016`	No fix yet

Description

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

References

securityfocus.com/bid/103718 · Third Party Advisory
helpx.adobe.com/security/products/coldfusion/apsb18-14.html · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · Third Party Advisory
CISA KEV · CVE-2018-4939

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free