Actively exploited · Published Apr 27, 2017 · Assigned by adobe
CVE-2017-3066
Critical 9.8 Exploited
In plain English
A critical-severity unsafe deserialization in Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier. Attackers are actively exploiting it in the wild (listed by CISA on February 24, 2025). The chance it is exploited in the next 30 days is estimated at 90.6% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Mar 17, 2025.
Official description
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier | Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- 43993 exploit, x_refsource_EXPLOIT-DB
- https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html x_refsource_CONFIRM
- 98003 vdb-entry, x_refsource_BID
- 1038364 vdb-entry, x_refsource_SECTRACK
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3066 government-resource