CVE-2022-35711: Adobe ColdFusion heap buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, combined with a very high EPSS score, makes this a top-priority patch for any internet-exposed ColdFusion instance.

What it is

Adobe ColdFusion Update 14 and earlier, and Update 4 and earlier, contain a heap-based buffer overflow (CWE-122/CWE-787) that can lead to arbitrary code execution as the current user. The flaw is reachable over the network with no authentication or user interaction, making it a serious pre-auth remote code execution risk for exposed servers.

Impact

An unauthenticated attacker can execute arbitrary code in the context of the ColdFusion service account, potentially leading to full server compromise. Depending on the account's privileges, this could expose configuration secrets, data stores and the underlying host.

Attack surface

Reached by sending a crafted network packet to the ColdFusion server, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication and no user interaction are required, so any network-reachable instance is a candidate target.

Exploitation

The record shows no CISA KEV listing and no exploit references, but EPSS is very high at roughly 0.735 (99.4th percentile), indicating strong predicted likelihood of exploitation activity. No public exploit code or in-the-wild confirmation is stated in the supplied data.

What to do

• Apply the Adobe ColdFusion update referenced in advisory APSB22-44 (patch first).
• If patching cannot be immediate, restrict network access to ColdFusion services to trusted hosts and block untrusted traffic at the perimeter.
• Run the ColdFusion service under a least-privilege account to limit the impact of code execution.
• Monitor vendor advisory APSB22-44 for any updated guidance or revised fixed versions.

Detection

• Inspect ColdFusion server and web server logs for malformed or anomalous requests targeting ColdFusion endpoints.
• Watch for unexpected child processes spawned by the ColdFusion service account, which may indicate code execution.
• Monitor for outbound connections or file writes originating from the ColdFusion process that deviate from normal behavior.
• Alert on crashes or restarts of the ColdFusion service that could correspond to memory corruption attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.