CVE-2023-44350

Adobe ColdFusion 2023.5 and 2021.11 and earlier deserialize untrusted data unsafely, and the result is arbitrary code execution with no user interaction required. An attacker sends crafted serialized data to a reachable ColdFusion server and gets code running on it — remote, unauthenticated, and direct. This is the highest-consequence class of web-server flaw, and ColdFusion typically runs application servers that sit close to sensitive data.

ColdFusion deserialization bugs have a long, ugly track record of being exploited in the wild, several landing on CISA's known-exploited list, so this isn't a hypothetical class. Adobe explicitly notes exploitation needs no user interaction, which is exactly the profile that draws fast proof-of-concept development and broad scanning. Internet-facing ColdFusion is a perennial target, and unauthenticated RCE against it should be assumed to attract attention quickly.

We treat this as top of the queue. The work is finding every ColdFusion instance — including forgotten and legacy application servers, which is where ColdFusion notoriously lingers — confirming which are internet-reachable, and getting them onto fixed builds without delay. Given the history, we also prime detection for exploitation attempts against these hosts rather than assuming patching will land before the scanners do.