Remote Code Execution in Adobe ColdFusion Deserialization

Successful exploitation can result in arbitrary code execution on the affected ColdFusion server. This can enable full compromise of the application environment, including execution of attacker-supplied commands or payloads, theft or manipulation of application data, deployment of persistence mechanisms such as webshells, privilege escalation depending on the service account context, and disruption of application availability. Because the flaw is remotely exploitable without user interaction and requires no authentication, the impact is severe for internet-exposed servers.

If immediate patching is not possible, reduce exposure by restricting public access to ColdFusion services and administrative interfaces, especially internet-facing application and management endpoints. Limit access through network controls, WAF rules, reverse proxy restrictions, and segmentation so only trusted users or systems can reach ColdFusion. Increase monitoring for exploitation attempts against exposed ColdFusion endpoints and investigate signs of post-exploitation such as unauthorized administrative changes, unexpected outbound connections, or server-side payload deployment. These measures only reduce risk and are not a substitute for vendor updates.

Upgrade to a fixed Adobe ColdFusion release: ColdFusion 2018 Update 19 or later, ColdFusion 2021 Update 9 or later, and ColdFusion 2023 Update 3 or later. Adobe also recommended updating the ColdFusion JDK/JRE LTS to the latest supported update release, noting that applying the ColdFusion update without the corresponding JDK update does not fully secure the server. Review and apply Adobe ColdFusion security configuration guidance and Lockdown recommendations after patching.