Skip to main content

Adobe ColdFusion CVE-2023-38203

CRITICAL
Deserialization of Untrusted Data (CWE-502)
2023-07-20 psirt@adobe.com
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Mar 26, 2026 - 11:19 vuln.today
Added to CISA KEV
Oct 23, 2025 - 11:13 cisa
CISA KEV
Patch released
Oct 23, 2025 - 11:13 nvd
Patch available
CVE Published
Jul 20, 2023 - 16:15 nvd
CRITICAL 9.8

DescriptionCVE.org

Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

AnalysisAI

Adobe ColdFusion contains a second deserialization vulnerability enabling unauthenticated RCE, disclosed shortly after CVE-2023-29300 and similarly exploited against government and enterprise targets.

Technical ContextAI

The CWE-502 deserialization flaw provides a second exploitation path for unauthenticated RCE through ColdFusion's serialization endpoints. Even organizations that patched CVE-2023-29300 remained vulnerable until this separate patch was applied.

Affected ProductsAI

Adobe ColdFusion 2018u17 and earlier Adobe ColdFusion 2021u7 and earlier Adobe ColdFusion 2023u1 and earlier

RemediationAI

Apply all ColdFusion security updates. Both CVE-2023-29300 and CVE-2023-38203 must be patched. Scan for web shells from both exploitation campaigns.

Share

CVE-2023-38203 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy