CVE-2023-44353: Adobe ColdFusion Untrusted Data Deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and very high EPSS probability make this an urgent patching priority.

What it is

Adobe ColdFusion 2023.5 and earlier and 2021.11 and earlier contain a deserialization of untrusted data flaw (CWE-502) that can lead to arbitrary code execution. The vulnerability is network-reachable and requires no user interaction, making it a serious risk for any internet-exposed ColdFusion instance.

Impact

A successful attacker can execute arbitrary code on the ColdFusion server, potentially leading to full system compromise. This can result in data theft, service disruption, or use of the host as a pivot point.

Attack surface

The flaw is reachable over the network (AV:N) with no privileges required (PR:N) and no user interaction (UI:N), per the CVSS vector. Any service or endpoint that deserializes untrusted input in the affected ColdFusion versions is a potential entry point.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit references, but EPSS is very high (0.80, 99.6th percentile), indicating a strong likelihood of exploitation activity. No ransomware group usage is documented.

What to do

• Apply the vendor patch from Adobe security bulletin APSB23-52 immediately.
• If patching is not possible, restrict network access to ColdFusion administrative and application endpoints to trusted sources only.
• Enable and review ColdFusion security settings, including disabling unnecessary RMI or deserialization-exposed services.
• Monitor for unexpected outbound connections or child processes spawned by the ColdFusion service.
• Validate that all ColdFusion instances are on a supported version and remove or isolate end-of-life deployments.

Detection

• Monitor ColdFusion server logs for deserialization errors or unexpected class loading events.
• Alert on unusual child processes (e.g., cmd.exe, powershell.exe, /bin/sh) spawned by the ColdFusion service account.
• Inspect network traffic for serialized Java objects or suspicious payloads sent to ColdFusion endpoints.
• Track file creation or modification in ColdFusion web directories that could indicate webshell deployment.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.