Class familyAdobe · ColdFusion
Adobe ColdFusion deserialization flaws, 2017–2025
18 ColdFusion CVEs with CWE-502 weaknesses, 27 Apr 2017 to 9 Dec 2025. 5 are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
1 2017’17
5 2018’18
2019’19
2020’20
2021’21
2022’22
7 2023’23
1 2024’24
4 2025’25
In CISA KEVNot in KEV
20171 CVE, 1 in KEV
20185 CVEs, 1 in KEV
20237 CVEs, 3 in KEV
20241 CVE
20254 CVEs
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2017-3066KEV | 27 Apr 2017 | Adobe ColdFusion Deserialization Vulnerability | Grouped by weakness | 73.7 |
| CVE-2018-4939KEV | 19 May 2018 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Grouped by weakness | 64.7 |
| CVE-2018-15957 | 25 Sep 2018 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a… | Grouped by weakness | 26.5 |
| CVE-2018-15958 | 25 Sep 2018 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a… | Grouped by weakness | 26.5 |
| CVE-2018-15959 | 25 Sep 2018 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a… | Grouped by weakness | 26.5 |
| CVE-2018-15965 | 25 Sep 2018 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a… | Grouped by weakness | 26.5 |
| CVE-2023-26359KEV | 23 Mar 2023 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Grouped by weakness | 64.3 |
| CVE-2023-29300KEV | 12 Jul 2023 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Grouped by weakness | 79.9 |
| CVE-2023-38203KEV | 20 Jul 2023 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Grouped by weakness | 79.8 |
| CVE-2023-38204 | 14 Sep 2023 | Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8 | Grouped by weakness | 62.8 |
| CVE-2023-44350 | 17 Nov 2023 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | Grouped by weakness | 26.7 |
| CVE-2023-44351 | 17 Nov 2023 | Adobe ColdFusion RCE Security Vulnerability | Grouped by weakness | 26.6 |
| CVE-2023-44353 | 17 Nov 2023 | ColdFusion WDDX Deserialization Gadgets | Grouped by weakness | 72.5 |
| CVE-2024-41874 | 13 Sep 2024 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | Grouped by weakness | 26.5 |
| CVE-2025-24447 | 8 Apr 2025 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | Grouped by weakness | 22.8 |
| CVE-2025-30284 | 8 Apr 2025 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | Grouped by weakness | 22.3 |
| CVE-2025-30285 | 8 Apr 2025 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | Grouped by weakness | 25.5 |
| CVE-2025-61810 | 9 Dec 2025 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | Grouped by weakness | 25.0 |