← Vulnerability feed

Vulnerability record · CVE-2023-44350 · published 17 November 2023

CVE-2023-44350: Adobe ColdFusion untrusted data deserialization allows code execution

Adobe · Coldfusion

Adobe ColdFusion 2023.5 and earlier and 2021.11 and earlier deserialize untrusted data, which can lead to arbitrary code execution. The flaw is remotely reachable with no authentication or user interaction, making it a serious risk for any internet-exposed ColdFusion server.

9.8 CVSS 3.1 Critical EPSS 65% · top 0.8% CWE-502 · Deserialization of untrusted data
9.8CVSS 3.1 base score
65%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and very high EPSS probability make this a top-priority patch.

What it is

Adobe ColdFusion 2023.5 and earlier and 2021.11 and earlier deserialize untrusted data, which can lead to arbitrary code execution. The flaw is remotely reachable with no authentication or user interaction, making it a serious risk for any internet-exposed ColdFusion server.

Impact

An unauthenticated attacker can execute arbitrary code on the affected server, gaining full control of the ColdFusion process and potentially the underlying host.

Attack surface

Reached over the network via the affected ColdFusion endpoints, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.64558 (99.2nd percentile), indicating a high likelihood of attempted exploitation. References are vendor advisories only, with no public exploit details provided in the record.

What to do

  • Apply the Adobe ColdFusion update referenced in advisory APSB23-52 for your release branch.
  • Restrict network access to ColdFusion administrative and application endpoints to trusted hosts.
  • Enable and enforce ColdFusion sandbox and deserialization hardening settings where available.
  • Monitor for and remove unnecessary or exposed ColdFusion services from the public internet.
  • Review server logs and process behavior for signs of post-exploitation activity.

Detection

  • Monitor ColdFusion application and web server logs for unexpected deserialization errors or unusual request patterns.
  • Alert on new or unexpected child processes spawned by the ColdFusion service.
  • Watch for outbound connections from ColdFusion hosts to unfamiliar destinations.
  • Track file writes or new web shells in ColdFusion web roots and temp directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html Release NotesVendor Advisory
https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html Release NotesVendor Advisory

Track CVE-2023-44350 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-48282Adobe ColdFusion path traversal leads to remote code executionColdFusion versions 2025.9, 2023.20 and earlier contain a path traversal flaw (CWE-22) that allows an unauthenticated remote attacker to reach files …KEVEPSS 42%analysed9.8CVE-2023-38203Adobe ColdFusion untrusted data deserialization allows remote code executionAdobe ColdFusion 2018u17, 2021u7, and 2023u1 (and earlier) are affected by a deserialization of untrusted data flaw that can lead to arbitrary code e…KEVEPSS 97%analysed9.8CVE-2023-29300Adobe ColdFusion untrusted data deserialization allows code executionAdobe ColdFusion 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier deserialize untrusted data, which can lead to arbitrary cod…KEVEPSS 100%analysed9.8CVE-2023-26359Adobe ColdFusion untrusted data deserialization allows code executionAdobe ColdFusion 2018 Update 15 and earlier and 2021 Update 5 and earlier deserialize untrusted data, which can lead to arbitrary code execution in t…KEVEPSS 17%analysed9.8CVE-2018-15961Adobe ColdFusion unrestricted file upload leads to code executionAdobe ColdFusion (July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier) allows unrestricted file uploads. An uploaded fil…KEVEPSS 100%analysed9.8CVE-2018-4939Adobe ColdFusion Deserialization of Untrusted Data Enables Code ExecutionAdobe ColdFusion Update 5 and earlier and ColdFusion 11 Update 13 and earlier contain a deserialization of untrusted data flaw (CWE-502). A remote, u…KEVEPSS 62%analysed9.8CVE-2017-3066Adobe ColdFusion Java deserialization in Apache BlazeDS allows RCEAdobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier contain a Java deserializati…KEVEPSS 91%analysed9.8CVE-2013-0632Adobe ColdFusion RDS default password authentication bypassAdobe ColdFusion 9.0 through 10 ships administrator.cfc with an RDS component that accepts a default empty password. An attacker can log in to RDS wi…KEVEPSS 94%analysed

Source: NIST National Vulnerability Database (record CVE-2023-44350), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.