Adobe · ColdFusion

CVE-2017-3066

Adobe ColdFusion Deserialization Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 91%

What it is

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

CISA: Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: March 17, 2025

Added to the CISA list: February 24, 2025
Published: April 27, 2017
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 91% in the top 0.2% of all known vulnerabilities
Weakness: CWE-502
More details: NVD · CVE.org · CISA

All references (4)

More exploited flaws from Adobe

Added	Vulnerability	Product	Severity	Attack chance
Jul 7, 2026	Path TraversalCVE-2026-48282	ColdFusion	Critical 10.0	42%
Dec 16, 2024	Improper Access ControlCVE-2024-20767	ColdFusion	High 7.4	99%
Jan 8, 2024	Deserialization of Untrusted DataCVE-2023-29300used by ransomware	ColdFusion	Critical 9.8	>99.9%
Jan 8, 2024	Deserialization of Untrusted DataCVE-2023-38203used by ransomware	ColdFusion	Critical 9.8	97%
Aug 21, 2023	Deserialization of Untrusted DataCVE-2023-26359	ColdFusion	Critical 9.8	17%
Jul 20, 2023	Improper Access ControlCVE-2023-29298	ColdFusion	High 7.5	99.8%
Jul 20, 2023	Improper Access ControlCVE-2023-38205	ColdFusion	High 7.5	99.8%
Mar 15, 2023	Deserialization of Untrusted DataCVE-2023-26360	ColdFusion	High 8.6	97%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.