VULNERABILITY INTELLIGENCE

CVE-2023-38203

CVSS score9.8 CRITICAL

EPSS probability97.07%

CISA KEVKnown exploited vulnerability

Published2023-07-20

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Vendor / product: Adobe / ColdFusion

Description

Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

Weakness classification

psirt@adobe.com: CWE-502

Primary references

psirt@adobe.com — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Third Party Advisory, US Government Resource