Adobe ColdFusion Deserialization Vulnerability Leading to Arbitrary Code Execution

A deserialization of untrusted data vulnerability has been identified in Adobe ColdFusion versions 2023.12, 2021.18, and 2025.0 and earlier. This vulnerability could allow arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this issue to bypass security protections and execute code, although exploitation requires user interaction.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the affected system, allowing an attacker to execute malicious code in the context of the current user.