CVE-2022-35690: Adobe ColdFusion stack buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, combined with a 99.4th percentile EPSS score, makes this a top-priority patch despite no KEV listing.

What it is

Adobe ColdFusion Update 14 and earlier, and Update 4 and earlier, contain a stack-based buffer overflow (CWE-121/CWE-787) reachable over the network. A crafted packet triggers the flaw without authentication or user interaction, and successful exploitation can execute arbitrary code as the current user.

Impact

An unauthenticated remote attacker can run arbitrary code in the context of the ColdFusion service account, potentially leading to full server compromise. The CVSS 3.1 base score is 9.8 (critical) with high confidentiality, integrity and availability impact.

Attack surface

Reached over the network via a crafted packet sent to the ColdFusion server; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required. The description does not name the specific endpoint or port, so defenders should treat any externally reachable ColdFusion listener as exposed.

Exploitation

The record is not listed in CISA KEV and no ransomware use is documented, but EPSS is 0.72213 (99.4th percentile), indicating a high modeled likelihood of exploitation. The only references are Adobe's APSB22-44 advisory tagged Patch and Vendor Advisory; no public exploit or in-the-wild report is cited in this record.

What to do

• Apply the Adobe ColdFusion update referenced in APSB22-44 (Update 15 or later for the 2021 line, Update 5 or later for the 2018 line) as the primary fix.
• If immediate patching is not possible, restrict network access to ColdFusion services with firewall rules and place the server behind a reverse proxy or WAF.
• Disable or block unnecessary ColdFusion ports and administrative interfaces from untrusted networks.
• Run the ColdFusion service under a least-privilege account to limit the impact of code execution.
• Monitor Adobe's advisory page for any revised guidance or updated fixed versions.

Detection

• Inspect ColdFusion server and web server logs for malformed or unusually large requests, especially to ColdFusion-specific endpoints, that precede crashes or restarts.
• Monitor for unexpected child processes spawned by the ColdFusion service (java, coldfusion.exe) or outbound connections from the server.
• Watch for service crashes, core dumps or JVM errors on ColdFusion hosts, which can indicate a buffer overflow attempt.
• Use network monitoring to flag anomalous packet patterns or payload sizes directed at ColdFusion listeners.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.