Adobe ColdFusion Deserialization Vulnerability Leading to Arbitrary Code Execution

A deserialization of untrusted data vulnerability has been identified in Adobe ColdFusion versions 2023.12, 2021.18, and 2025.0 and earlier. This vulnerability could allow for arbitrary code execution in the context of the current user, posing a high risk to confidentiality and integrity. Notably, exploitation of this issue does not require user interaction.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution, allowing an attacker to execute malicious code in the context of the current user.