CVE-2018-4939

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

Affected

Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

61.99% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2021-11-03

Published

2018-05-19

Updated

2025-10-21

Proof-of-concept exploits (1)

• Ginove/post0★ · 2021-05-16

Security advisories

• https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html
• http://www.securityfocus.com/bid/103718
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4939

References

• CVE Record
• NVD entry

Related

• CVE-2018-14716