CVE-2017-3066: Adobe ColdFusion Deserialization Vulnerability
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
Other sources
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3066?
CVE-2017-3066 is classified as critical due to its potential for arbitrary code execution.
How do I fix CVE-2017-3066?
To mitigate CVE-2017-3066, update Adobe ColdFusion to a version that has addressed this vulnerability.
Which versions of Adobe ColdFusion are affected by CVE-2017-3066?
CVE-2017-3066 affects Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, and ColdFusion 10 Update 22 and earlier.
What can attackers achieve through CVE-2017-3066?
Successful exploitation of CVE-2017-3066 could allow attackers to execute arbitrary code on the affected system.
Is there a workaround for CVE-2017-3066 if I cannot update?
While a specific workaround for CVE-2017-3066 is not provided, limiting access to the affected services can help reduce the risk until an update is applied.