CVE-2017-3066criticalunder attackCWE-502

CVE-2017-3066: critical vulnerability in Adobe ColdFusion ColdFusion 2016 Update 3 and…

Published · Updated

Follow this CVE+ Monitor ColdFusion+ Monitor earlier

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 91%
from disclosure to weapon286 days
Published on NVDApr 27
1st PoC+286d
CISA KEV+2860d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateRocke🇨🇳 MITRE ATT&CK
Action required by CISAfederal deadline: 2025-03-17

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Adobe ColdFusion contains a flaw in how it processes serialized Java objects from the Apache BlazeDS library, allowing attackers to execute arbitrary code on the server without authentication.

Technical detail

A Java deserialization vulnerability (CWE-502) in Apache BlazeDS allows remote attackers to instantiate arbitrary objects by sending specially crafted serialized data to vulnerable ColdFusion versions, leading to unauthenticated remote code execution.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.