CVE-2023-38203: Adobe ColdFusion untrusted data deserialization allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, active exploitation in the wild with known ransomware use, and a very high EPSS score make this an urgent patching priority.

What it is

Adobe ColdFusion 2018u17, 2021u7, and 2023u1 (and earlier) are affected by a deserialization of untrusted data flaw that can lead to arbitrary code execution. The vulnerability is remotely reachable without authentication or user interaction, making it a severe risk for internet-exposed ColdFusion servers.

Impact

An unauthenticated attacker can execute arbitrary code on the target server, potentially leading to full system compromise. This can result in data theft, ransomware deployment, or use of the server as a pivot point into the network.

Attack surface

The flaw is reachable over the network via the affected ColdFusion service, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required to trigger the vulnerability.

Exploitation

The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with known ransomware campaign use, and EPSS indicates a very high probability of exploitation (97% over 30 days).

What to do

• Apply the vendor patch from Adobe security bulletin APSB23-41 immediately.
• If patching is not possible, follow CISA's required action to apply mitigations per vendor instructions or discontinue use of the product.
• Restrict network access to ColdFusion servers to trusted IP ranges and disable unnecessary services.
• Monitor for signs of exploitation and consider isolating affected systems until patched.
• Review and harden deserialization endpoints if custom code is present.

Detection

• Monitor for unexpected child processes spawned by ColdFusion (e.g., cmd.exe, powershell.exe) that may indicate code execution.
• Inspect network traffic for deserialization payloads targeting ColdFusion endpoints, especially unusual serialized objects.
• Review ColdFusion logs for errors or anomalies related to deserialization or unexpected remote requests.
• Use endpoint detection to alert on suspicious file writes or registry changes originating from the ColdFusion process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.