What is the CVSS score of CVE-2025-61810?

CVE-2025-61810 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 9.5%.

Which versions of Adobe ColdFusion are affected by CVE-2025-61810?

Adobe ColdFusion servers running version 2025.4, 2023.16, 2021.22 or earlier are exposed to a high-severity (CVSS 8.4) flaw that could allow an attacker to run arbitrary code on the application…

How to fix or mitigate CVE-2025-61810?

Within 24 hours, inventory every ColdFusion instance across the estate and confirm which run 2025.4, 2023.16, 2021.22 or earlier, then restrict external and cross-segment network reachability to those servers with priority on admin consoles, remote-management interfaces, and any deserialization or RMI endpoints, and review the Adobe advisory APSB25-105 for the vendor's current guidance and any interim mitigations it prescribes. Within 7 days, enforce least privilege by auditing and reducing the number of accounts holding high-privilege ColdFusion roles, mandate multi-factor authentication for all ColdFusion administrative and developer access, remove or disable unused accounts and integrations, place externally reachable instances behind a web application firewall with rules targeting suspicious serialized payloads, and enable and centrally collect application and access logging so anomalous deserialization or admin activity is detectable. Within 30 days, continue tracking APSB25-105 for a vendor fix version and apply it as soon as released, re-validate that compensating controls are still enforced rather than assumed, re-scan the estate to confirm no new or forgotten ColdFusion deployments appeared, and rehearse incident response for a server-side code-execution scenario on this platform, including containment of a compromised ColdFusion host and credential rotation for any high-privilege account that may have been touched.

Adobe ColdFusion CVE-2025-61810

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-12-10 psirt@adobe.com

RCE Java Deserialization Coldfusion

8.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.4 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

Network-reachable deserialization RCE requiring a high-privilege account (PR:H) and victim interaction (UI:R); low complexity once gated, full triad impact with scope change to underlying OS/user context.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 25, 2026 - 23:40 vuln.today

tag: Java added

Analysis Generated

Sep 25, 2026 - 23:36 vuln.today

CVE Published

Dec 10, 2025 - 00:16 cve.org

HIGH 8.4

DescriptionCVE.org

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier can occur when a high-privileged attacker supplies maliciously crafted serialized data and induces user interaction to trigger deserialization. The flaw is network-reachable and, if exploited, can change scope and fully compromise confidentiality, integrity, and availability, but it requires an authenticated high-privilege (PR:H) account plus a user action (UI:R), so it is not remotely unauthenticated. No public exploit identified at time of analysis; no CISA KEV status is provided, EPSS is 9.54% (95th percentile), and Adobe has published advisory APSB25-105 for patching.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) is the root cause: ColdFusion deserializes attacker-controlled serialized input without sufficient validation, enabling object injection and arbitrary code execution in the application runtime context. CPE data maps affected builds to Adobe ColdFusion 2021, including numerous 2021 updates, as well as the 2023 and 2025 branches; the advisory APSB25-105 covers ColdFusion 2025.4, 2023.16, 2021.22 and earlier. The CVSS vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H confirms the network attack vector and low complexity, but also that exploitation requires high privileges and user interaction, with scope change and full confidentiality, integrity, and availability impact once the deserialization path is reached.

RemediationAI

Apply the vendor patch referenced in Adobe security bulletin APSB25-105 (https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html); patch available per vendor advisory for the affected ColdFusion branches, so upgrade ColdFusion 2025, 2023, and 2021 installations to the versions specified in that advisory. Because the exact fixed version numbers are not included in the supplied data, verify them in the advisory before upgrading. Until patching is complete, restrict network access to ColdFusion administrative interfaces and any endpoints that deserialize user-supplied data to trusted administrative networks; enforce strong authentication and MFA for high-privileged accounts; and review logs for unexpected deserialization activity, accepting that such controls may limit legitimate admin workflows and are compensating measures rather than a substitute for the update.