UpHeron
All vulnerabilities

Servers and applications

CVE-2017-3066

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 24 Feb 2025.

Severity
Critical 9.8
Published
27 Apr 2017
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
91% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Deserialization of untrusted data (CWE-502)
Attack
Over the network · No login needed · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Affected software

SoftwareAffected versions
Adobe ColdFusionServers and applications · cpe:a:adobe:coldfusion
  • Version 2016-update3
  • Version 2016-update2
  • Version 2016-update1
  • Version 2016
All 39 release lines
  • Version 10.0
  • Version 10.0-update1
  • Version 10.0-update2
  • Version 10.0-update3
  • Version 10.0-update4
  • Version 10.0-update5
  • Version 10.0-update6
  • Version 10.0-update7
  • Version 10.0-update8
  • Version 10.0-update9
  • Version 10.0-update10
  • Version 10.0-update11
  • Version 10.0-update12
  • Version 10.0-update13
  • Version 10.0-update14
  • Version 10.0-update15
  • Version 10.0-update16
  • Version 10.0-update17
  • Version 10.0-update18
  • Version 10.0-update19
  • Version 10.0-update20
  • Version 10.0-update21
  • Version 10.0-update22
  • Version 11.0
  • Version 11.0-update1
  • Version 11.0-update2
  • Version 11.0-update3
  • Version 11.0-update4
  • Version 11.0-update5
  • Version 11.0-update6
  • Version 11.0-update7
  • Version 11.0-update8
  • Version 11.0-update9
  • Version 11.0-update10
  • Version 11.0-update11
  • Version 2016
  • Version 2016-update1
  • Version 2016-update2
  • Version 2016-update3

Known exploited

CISA name
Adobe ColdFusion Deserialization Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
17 Mar 2025
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-3066
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-3066