CVE-2023-38204: Adobe ColdFusion untrusted data deserialization allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and very high EPSS make this an urgent patch target despite no KEV listing.

What it is

Adobe ColdFusion 2018u18, 2021u8 and 2023u2 (and earlier) are affected by a deserialization of untrusted data flaw that can lead to arbitrary code execution. The vulnerability is remotely reachable without authentication or user interaction, making it a serious risk for internet-facing ColdFusion servers.

Impact

An unauthenticated attacker can execute arbitrary code on the affected server, potentially leading to full system compromise, data theft, or deployment of further payloads.

Attack surface

The CVSS vector indicates network reachability with no privileges or user interaction required, so any exposed ColdFusion endpoint that processes untrusted serialized data is in scope. The record does not specify the exact endpoint or component.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high at 0.66837 (99.257th percentile), indicating strong likelihood of exploitation activity. The only references are vendor advisories, so no public exploit details are confirmed in this record.

What to do

• Apply the Adobe ColdFusion security update referenced in APSB23-47 for your version (2018u19, 2021u9, 2023u3 or later).
• If patching is delayed, restrict network access to ColdFusion administrative and application endpoints to trusted sources only.
• Enable and review ColdFusion security lockdown and deserialization filters where available.
• Monitor for and block unexpected outbound traffic from ColdFusion servers that could indicate post-exploitation activity.
• Verify no unauthorized changes to ColdFusion configuration files or scheduled tasks after patching.

Detection

• Monitor ColdFusion server logs for deserialization errors, unexpected class loading, or unusual Java exceptions.
• Alert on suspicious child processes spawned by the ColdFusion service (e.g., cmd.exe, powershell.exe, /bin/sh).
• Inspect network traffic for serialized Java objects sent to ColdFusion endpoints from untrusted sources.
• Review file system changes in ColdFusion webroot and configuration directories for webshells or modified components.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.