Adobe ColdFusion Deserialization Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 24/02/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| coldfusion | = 10.0= 11.0= 2016 |
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free