Vulnerability · Published Apr 8, 2025 · Assigned by adobe
CVE-2025-24447ColdFusion | Deserialization of Untrusted Data (CWE-502)
Critical 9.1
In plain English
A critical-severity unsafe deserialization in ColdFusion from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)2.2%top 17.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does not require user interaction.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | ColdFusion | 0 – through 2025.0 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N