CVE-2023-29300
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Published Jul 12, 2023 · updated Jun 16, 2026 · adobe coldfusion
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jul 12, 2023 · Catalog
Detected
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Jan 8, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jan 29, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Jan 29, 2024
Affected
- cpe adobe/coldfusion2018
- vendor Adobe ColdFusionversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2023-29300
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
cisa.gov - CVE.orgVulnerability recordCVE-2023-29300
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2023-29300
30-day exploitation probability 100.0%
first.org - NIST NVDVulnerability recordCVE-2023-29300
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
nvd.nist.gov