Adobe ColdFusion Deserialization Vulnerability Leading to Arbitrary Code Execution

A deserialization vulnerability allowing arbitrary code execution has been identified in Adobe ColdFusion versions 2025.4, 2023.16, and 2021.22 and earlier. This vulnerability arises from improper handling of untrusted data, which could be exploited by a high-privileged attacker who provides maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction.

Impact

Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the current user.

Remediation

Users are advised to update to ColdFusion 2025 Update 5, ColdFusion 2023 Update 17, or ColdFusion 2021 Update 23. For more information on these updates, refer to the Adobe ColdFusion Security Bulletin APSB25-105.