CVE-2023-44351: Adobe ColdFusion untrusted data deserialization allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, combined with a high EPSS percentile, makes this a top-priority patch despite no KEV listing.

What it is

Adobe ColdFusion 2023.5 and earlier and 2021.11 and earlier are affected by a deserialization of untrusted data flaw (CWE-502) that can lead to arbitrary code execution. The vulnerability is remotely reachable with no authentication or user interaction, making it a serious risk for internet-exposed ColdFusion servers.

Impact

An unauthenticated attacker can execute arbitrary code on the affected server, potentially taking full control of the host and any data or services it can reach.

Attack surface

The CVSS vector is network-based (AV:N) with no privileges (PR:N) and no user interaction (UI:N), so the flaw is reachable directly over the network without credentials or a victim action. The record does not specify the exact endpoint or component involved.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.50 (98.9th percentile), indicating elevated likelihood of exploitation activity. The only references are Adobe's vendor advisory and release notes, with no public exploit or in-the-wild reporting cited in the record.

What to do

• Apply the Adobe ColdFusion updates in APSB23-52 (2023.5 and 2021.11 or later) as the primary fix.
• If immediate patching is not possible, restrict network access to ColdFusion administrative and application endpoints to trusted sources only.
• Enable and enforce ColdFusion security settings such as sandboxing and disable unused or risky features where supported.
• Monitor Adobe advisories for follow-up patches and verify the installed ColdFusion build against the fixed versions.
• Run the service with least privilege and isolate it from sensitive internal networks to limit post-exploitation reach.

Detection

• Monitor ColdFusion server logs and web access logs for unexpected POST requests or serialized payload patterns to application endpoints.
• Alert on child processes spawned by the ColdFusion service (java/cfservice) that are unusual for normal operation.
• Watch for outbound network connections from the ColdFusion host to unfamiliar destinations, which may indicate post-exploitation activity.
• Track file writes or new files in ColdFusion web directories and temporary folders that could indicate dropped payloads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.