Read the docs
TI-2017-02286 Aliases CVE-2017-3066GHSA-7cc9-8vjg-gpp8

Deserialization of untrusted data in Adobe ColdFusion ColdFusion 2016 Update 3 and…

Priority CRITICAL 100Exploited in the wildCWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-502.

Summary

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

Why it matters now

Exploitation Active In CISA KEV since 2025-02-24CISA due date 2025-03-17
EPSS 0.90597 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlierAdobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier—No fix listedCNA
  • Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier Vendor— Affected Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier Fixed in — No fix listed CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:adobe:coldfusion:10.0:-:*:*:*:*:*:*10.0VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update1:*:*:*:*:*:*10.0 update1VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update10:*:*:*:*:*:*10.0 update10VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update11:*:*:*:*:*:*10.0 update11VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update12:*:*:*:*:*:*10.0 update12VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update13:*:*:*:*:*:*10.0 update13VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update14:*:*:*:*:*:*10.0 update14VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update15:*:*:*:*:*:*10.0 update15VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update16:*:*:*:*:*:*10.0 update16VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update17:*:*:*:*:*:*10.0 update17VulnerableAdobe
  • cpe:2.3:a:adobe:coldfusion:10.0:-:*:*:*:*:*:* Versions 10.0 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update1:*:*:*:*:*:* Versions 10.0 update1 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update10:*:*:*:*:*:* Versions 10.0 update10 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update11:*:*:*:*:*:* Versions 10.0 update11 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update12:*:*:*:*:*:* Versions 10.0 update12 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update13:*:*:*:*:*:* Versions 10.0 update13 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update14:*:*:*:*:*:* Versions 10.0 update14 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update15:*:*:*:*:*:* Versions 10.0 update15 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update16:*:*:*:*:*:* Versions 10.0 update16 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update17:*:*:*:*:*:* Versions 10.0 update17 Vulnerable ·Adobe
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:adobe:coldfusion:10.0:update18:*:*:*:*:*:*10.0 update18VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update19:*:*:*:*:*:*10.0 update19VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update2:*:*:*:*:*:*10.0 update2VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update20:*:*:*:*:*:*10.0 update20VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update21:*:*:*:*:*:*10.0 update21VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update22:*:*:*:*:*:*10.0 update22VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update3:*:*:*:*:*:*10.0 update3VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update4:*:*:*:*:*:*10.0 update4VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update5:*:*:*:*:*:*10.0 update5VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update6:*:*:*:*:*:*10.0 update6VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update7:*:*:*:*:*:*10.0 update7VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update8:*:*:*:*:*:*10.0 update8VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update9:*:*:*:*:*:*10.0 update9VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:*11.0VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:*11.0 update1VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update10:*:*:*:*:*:*11.0 update10VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update11:*:*:*:*:*:*11.0 update11VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update2:*:*:*:*:*:*11.0 update2VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update3:*:*:*:*:*:*11.0 update3VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update4:*:*:*:*:*:*11.0 update4VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update5:*:*:*:*:*:*11.0 update5VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update6:*:*:*:*:*:*11.0 update6VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update7:*:*:*:*:*:*11.0 update7VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update8:*:*:*:*:*:*11.0 update8VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update9:*:*:*:*:*:*11.0 update9VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:*2016VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:*2016 update1VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:*2016 update2VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:*2016 update3VulnerableAdobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update18:*:*:*:*:*:* Versions 10.0 update18 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update19:*:*:*:*:*:* Versions 10.0 update19 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update2:*:*:*:*:*:* Versions 10.0 update2 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update20:*:*:*:*:*:* Versions 10.0 update20 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update21:*:*:*:*:*:* Versions 10.0 update21 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update22:*:*:*:*:*:* Versions 10.0 update22 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update3:*:*:*:*:*:* Versions 10.0 update3 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update4:*:*:*:*:*:* Versions 10.0 update4 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update5:*:*:*:*:*:* Versions 10.0 update5 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update6:*:*:*:*:*:* Versions 10.0 update6 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update7:*:*:*:*:*:* Versions 10.0 update7 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update8:*:*:*:*:*:* Versions 10.0 update8 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update9:*:*:*:*:*:* Versions 10.0 update9 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:* Versions 11.0 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:* Versions 11.0 update1 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update10:*:*:*:*:*:* Versions 11.0 update10 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update11:*:*:*:*:*:* Versions 11.0 update11 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update2:*:*:*:*:*:* Versions 11.0 update2 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update3:*:*:*:*:*:* Versions 11.0 update3 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update4:*:*:*:*:*:* Versions 11.0 update4 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update5:*:*:*:*:*:* Versions 11.0 update5 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update6:*:*:*:*:*:* Versions 11.0 update6 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update7:*:*:*:*:*:* Versions 11.0 update7 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update8:*:*:*:*:*:* Versions 11.0 update8 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update9:*:*:*:*:*:* Versions 11.0 update9 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:* Versions 2016 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:* Versions 2016 update1 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:* Versions 2016 update2 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:* Versions 2016 update3 Vulnerable ·Adobe

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2025-02-24 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2017-3066
  3. 2026-10-03 Alias added: GHSA-7cc9-8vjg-gpp8

References

Exploit 1

Patch 1

  • TI-2026-35688 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-19615 Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-13696 Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-11512 Adobe ColdFusion Improper Access Control Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-11511 Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-11393 Unrestricted file upload in Adobe ColdFusion KEVCVSS 3.1CRITICAL 9.8
See all 295 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences