CVE-2017-3066 — Adobe ColdFusion Deserialization Vulnerability
CVE-2017-3066: Adobe ColdFusion Deserialization Vulnerability
CISA Known Exploited Vulnerability (KEV)
| Vendor / project | Adobe |
| Product | ColdFusion |
| Date added | 2025-02-24 |
| Due date | 2025-03-17 |
| Ransomware campaign use | Unknown |
Description
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
Required action (CISA)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html ; https://nvd.nist.gov/vuln/detail/CVE-2017-3066
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-3066
- KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog