CVE-2017-3066: Adobe ColdFusion Java deserialization in Apache BlazeDS allows RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network, no-auth, no-interaction code execution, plus KEV listing, very high EPSS, and a public exploit make this an urgent patch target.

What it is

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier contain a Java deserialization flaw in the bundled Apache BlazeDS library. Untrusted data is deserialized without adequate validation, which can let an unauthenticated remote attacker execute arbitrary code on the server. Because ColdFusion is internet-facing in many deployments, this is a high-value target for initial access.

Impact

An attacker can run arbitrary code with the privileges of the ColdFusion service, leading to full server compromise, data theft, and use as a foothold for lateral movement.

Attack surface

Reachable over the network via the BlazeDS deserialization endpoint; the CVSS vector shows AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is required.

Exploitation

CVE-2017-3066 is listed in CISA KEV (added 2025-02-24) and has an EPSS 30-day probability of about 0.906 (99.8th percentile), and a public Exploit-DB entry exists, indicating active exploitation and mature public tooling.

What to do

• Apply the Adobe ColdFusion security update referenced in APSB17-14 (ColdFusion 2016 Update 4, 11 Update 12, or 10 Update 23 or later) as the first action.
• If patching is not immediately possible, follow Adobe's APSB17-14 mitigations or discontinue use of the affected ColdFusion version per CISA KEV guidance.
• Restrict network access to ColdFusion and BlazeDS endpoints so only trusted hosts can reach them.
• Remove or disable the BlazeDS library if it is not required by the application.
• Run the ColdFusion service under a low-privilege account to limit the impact of code execution.

Detection

• Monitor ColdFusion/BlazeDS HTTP requests for serialized Java payloads, especially AMF or binary content sent to BlazeDS endpoints.
• Alert on unexpected child processes spawned by the ColdFusion service (java.exe, coldfusion.exe) such as cmd.exe, powershell.exe, or wget/curl.
• Review ColdFusion logs and web server logs for anomalous POST requests to BlazeDS or messagebroker paths from untrusted sources.
• Hunt for outbound connections from the ColdFusion host to unusual destinations that could indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.