Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrust…

Published 8 y ago 2018-05-19 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.1 · CNA

CISA KEV

Yes

added 2021-11-03

EPSS

61.8%

percentile 99%

Public exploits

none known

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

Known exploited (CISA KEV)

Added: 5 y ago 2021-11-03
Due date: 2022-05-03 (4 y ago)
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Vendor / product: Adobe / ColdFusion
CISA name: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CISA SSVC assessment

Exploitation: Active — exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 21 mo ago 2025-02-04

Exploit prediction (EPSS)

61.78% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	10.0	`AV:N/AC:L/Au:N/C:C/I:C/A:C`

Affected products

n/a Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

References

helpx.adobe.com /security/products/coldfusion/apsb18-14.html · x_refsource_MISC, x_transferred
securityfocus.com /bid/103718 · vdb-entry, x_refsource_BID, x_transferred
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4939 · government-resource

Sources

CVE List: CVE-2018-4939
NVD: CVE-2018-4939

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary