CVE-2018-4939: Adobe ColdFusion Deserialization of Untrusted Data Enables Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, confirmed exploitation in CISA KEV, and a very high EPSS score make this an urgent patch-first vulnerability.

What it is

Adobe ColdFusion Update 5 and earlier and ColdFusion 11 Update 13 and earlier contain a deserialization of untrusted data flaw (CWE-502). A remote, unauthenticated attacker can supply crafted serialized data that the server deserializes, leading to arbitrary code execution. The flaw is critical because it requires no privileges or user interaction and can fully compromise the host.

Impact

Successful exploitation allows arbitrary code execution in the context of the ColdFusion service, giving the attacker full control of the affected server. This can lead to data theft, lateral movement, and persistent compromise of the host.

Attack surface

The vulnerability is network-reachable (CVSS vector AV:N) with no authentication (PR:N) and no user interaction (UI:N), meaning any remote attacker who can reach the ColdFusion service can attempt it. The description does not specify the exact endpoint or protocol, so defenders should treat all externally exposed ColdFusion interfaces as potentially reachable.

Exploitation

CVE-2018-4939 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), confirming active exploitation in the wild. EPSS gives a 30-day exploitation probability of 0.6208 (99.1st percentile), indicating very high likelihood of attempted exploitation.

What to do

• Apply the vendor update per Adobe security bulletin APSB18-14 immediately; this is the only complete fix.
• If patching cannot be done at once, restrict network access to ColdFusion services to trusted hosts only and remove direct internet exposure.
• Disable or restrict unused ColdFusion remote development and RMI/AMF endpoints that may accept serialized data.
• Monitor Adobe advisories for any follow-up updates and verify the installed ColdFusion build against the fixed versions.
• Run the ColdFusion service with least privilege and isolate it from sensitive internal networks to limit post-exploitation impact.

Detection

• Monitor ColdFusion server logs and web access logs for requests containing serialized Java object markers (for example, hex 0xACED or base64 'rO0') to ColdFusion endpoints.
• Alert on unexpected child processes spawned by the ColdFusion service (java.exe/cfusion.exe) such as cmd.exe, powershell.exe, or /bin/sh.
• Hunt for outbound network connections from the ColdFusion host to unusual external IPs or ports, which may indicate post-exploitation command and control.
• Review file system changes in ColdFusion web roots and temporary directories for dropped webshells or JSP files created outside normal deployment windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.