CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2017-3066

CVSS 9.8v3.1pub. 2017-04-27upd. 2026-04-22

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Adobe Coldfusion

    APP
    Adobe
    10.011.02016

CISA KEV — detailsi

Vendori
Adobe ↗
Producti
ColdFusion
Added to KEVi
February 24, 2025
Remediation deadline (US Federal)i
March 17, 2025(overdue)
Required action (CISA)i

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 17 marca 2025
Tags
RCEDeserialization
CWE
References

Related vulnerabilities

CVE-2023-38203CRITICAL9.8⚠ KEVten sam produkt

Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by...

CVE-2023-29300CRITICAL9.8⚠ KEVten sam produkt

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are af...

CVE-2023-26359CRITICAL9.8⚠ KEVten sam produkt

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deser...

CVE-2018-15961CRITICAL9.8⚠ KEVten sam produkt

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier h...

CVE-2018-4939CRITICAL9.8⚠ KEVten sam produkt

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitab...