CVE-2017-3066

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

Affected

Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

90.60% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2025-02-24

Published

2017-04-27

Updated

2025-10-21

Proof-of-concept exploits (4)

• Pocm0n/Web-Coldfusion-Vulnerability-POC3★ · 2022-07-03
• codewhitesec/ColdFusionPwn95★ · 2022-10-18
• cucadili/CVE-2017-30662★ · 2019-10-09
• depthsecurity/coldfusion_blazeds_des11★ · 2018-02-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/43993

Vulhub environments (1)

• vulhub/vulhub/tree/master/coldfusion/CVE-2017-3066

Security advisories

• https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html
• http://www.securityfocus.com/bid/98003
• http://www.securitytracker.com/id/1038364

References

• CVE Record
• NVD entry

Related

• CVE-2018-15961
• CVE-2018-0824
• CVE-2018-11776