CVE-2023-29300: Adobe ColdFusion untrusted data deserialization allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated remote code execution, active exploitation in CISA KEV with ransomware use, and near-maximum EPSS make this an urgent patch.

What it is

Adobe ColdFusion 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier deserialize untrusted data, which can lead to arbitrary code execution. The flaw is remotely reachable without authentication or user interaction, making it a severe risk for any internet-exposed ColdFusion server.

Impact

An unauthenticated attacker can execute arbitrary code on the ColdFusion server, potentially taking full control of the host and any data it processes.

Attack surface

Reachable over the network via the affected ColdFusion service; the CVSS vector shows no privileges required and no user interaction, so no authentication is needed.

Exploitation

Listed in CISA KEV with a due date of 2024-01-29 and flagged for known ransomware campaign use, and EPSS is near 1.0, indicating active exploitation in the wild.

What to do

• Apply the vendor patch from Adobe security bulletin APSB23-40 for your ColdFusion version.
• If patching is not immediately possible, follow Adobe's mitigation guidance or discontinue use of the affected product.
• Restrict network access to ColdFusion administrative and application endpoints to trusted sources only.
• Monitor for and block known exploitation attempts against ColdFusion deserialization endpoints.
• Verify no unauthorized changes or web shells exist on ColdFusion hosts after patching.

Detection

• Hunt for suspicious deserialization payloads or unusual serialized objects in ColdFusion request logs.
• Monitor for unexpected child processes spawned by the ColdFusion service (e.g., cmd.exe, powershell, or shell).
• Alert on new or modified files in ColdFusion web directories that could indicate dropped web shells.
• Review network connections from ColdFusion hosts to unusual external destinations for post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.