CVE-2023-38203

What it actually does

This is a network-exploitable deserialization vulnerability in Adobe ColdFusion that allows an unauthenticated attacker to submit crafted serialized data to a vulnerable ColdFusion component and cause the server-side runtime to instantiate attacker-controlled objects. Successful exploitation can lead to arbitrary code execution with the privileges of the ColdFusion service account, enabling command execution, web shell deployment, data access, configuration theft, and further movement from the application server.

Why it matters to the business

Unpatched internet-facing ColdFusion systems can be fully compromised without user interaction. Because this vulnerability is in CISA KEV, has a very high EPSS score, is documented as actively exploited in the wild, and is associated with ransomware campaigns, affected systems should be treated as urgent remediation targets. A successful compromise can disrupt business applications, expose sensitive data, enable ransomware deployment, and create a foothold into adjacent systems.

How an attack unfolds

An attacker first identifies an exposed ColdFusion instance running a vulnerable release. They send a specially crafted request containing malicious serialized data to a ColdFusion endpoint that processes that input. The vulnerable server deserializes the data without sufficient trust validation, triggering attacker-controlled behavior inside the Java/ColdFusion runtime. The attacker then executes operating system commands or writes server-side ColdFusion files to establish persistence, commonly by deploying a web shell. After gaining code execution, the attacker may enumerate configuration files, steal credentials or tokens, access application data, stage tools, disable defenses, move laterally, or deploy ransomware. Exploitation has been observed in the wild and should be investigated as a potential full server compromise, not merely a failed web attack.

How to fix it

Upgrade Adobe ColdFusion to a fixed release immediately: ColdFusion 2018 Update 18 or later, ColdFusion 2021 Update 8 or later, and ColdFusion 2023 Update 2 or later. If the provided downstream package mapping applies, update fogproject/fogproject to commit 2e2421f19620669b9930f72fb73a8dbc5efe4980 or a later version containing that fix. After patching, restart ColdFusion services and confirm the active update level from the ColdFusion Administrator or command-line version output. Restrict access to CFIDE, administrator, adminapi, and other management interfaces to trusted administrative networks only. Place ColdFusion behind a reverse proxy or WAF where feasible, block direct internet access to administrative paths, and disable unused components. Because exploitation is known and ransomware-associated, patching alone is insufficient for exposed systems: perform compromise assessment, remove unauthorized files, rotate secrets stored on or used by the application server, and rebuild systems where web shell or post-exploitation activity is confirmed.

How to confirm the fix worked

Confirm the deployed ColdFusion update level is newer than the vulnerable versions: 2018 Update 18+, 2021 Update 8+, or 2023 Update 2+. Verify that management paths such as /CFIDE/administrator/ and /CFIDE/adminapi/ are not reachable from untrusted networks. Review package or source-control inventory for fogproject/fogproject and confirm commit 2e2421f19620669b9930f72fb73a8dbc5efe4980 or later if applicable. Use authenticated vulnerability scanning or configuration management data rather than banner checks alone, because exposed banners may be hidden or inaccurate. After remediation, test that ColdFusion services restarted cleanly, application functionality remains intact, and no unexpected .cfm, .cfc, .jsp, or executable files remain in web-accessible directories.

Typical attack path

1. Scan the internet or internal address space for exposed Adobe ColdFusion services and CFIDE paths.
2. Fingerprint the ColdFusion version or infer vulnerability from response behavior, headers, file paths, or known endpoints.
3. Send a crafted deserialization payload to a vulnerable ColdFusion component without needing authentication or user interaction.
4. Achieve arbitrary code execution under the ColdFusion service account.
5. Write or invoke a web shell, run system commands, or download additional tooling.
6. Collect application configuration, database credentials, API keys, session material, and local files accessible to the service account.
7. Use the compromised server as a foothold for persistence, lateral movement, data theft, or ransomware deployment.

How to detect it

Investigate web server access logs, ColdFusion logs, reverse proxy logs, WAF events, EDR telemetry, process creation logs, DNS logs, and filesystem timelines. Focus on requests to CFIDE, administrator, adminapi, wizards, and ColdFusion component endpoints, especially POST requests, unusual serialized payloads, suspicious user agents, encoded parameters, repeated probing, 500 errors, or requests followed by new server-side files. Review ColdFusion log files such as application.log, exception.log, server.log, coldfusion-out.log, coldfusion-error.log, and web server connector logs. Look for the ColdFusion or Java process spawning shells or scripting tools such as cmd.exe, powershell.exe, bash, sh, curl, wget, certutil, bitsadmin, or rundll32. Inspect web-accessible directories for recently created or modified .cfm, .cfc, .jsp, .jspx, .war, .jar, .class, .exe, .dll, .sh, and archive files. Correlate suspected exploit requests with outbound network connections, new scheduled tasks or services, credential dumping attempts, ransomware staging, and abnormal access to application configuration files. Because this vulnerability has been exploited in ransomware activity, expand hunting beyond the web server to identity systems, file shares, backup infrastructure, and any systems reachable with credentials stored on the ColdFusion host.

• /CFIDE/adminapi/
• /CFIDE/administrator/
• /CFIDE/wizards/
• /cfusion/adminapi/
• /cfusion/administrator/
• POST /CFIDE/
• POST /CFIDE/adminapi/
• POST /CFIDE/administrator/
• wddxPacket
• org.apache.commons.collections.functors.InvokerTransformer
• javax.management.BadAttributeValueExpException
• ysoserial
• cfusion/logs/exception.log
• cfusion/logs/application.log
• cfusion/logs/server.log
• cfusion/logs/coldfusion-out.log
• cfusion/logs/coldfusion-error.log
• ColdFusion2023/cfusion/logs/
• ColdFusion2021/cfusion/logs/
• ColdFusion2018/cfusion/logs/
• java.exe -> cmd.exe
• java.exe -> powershell.exe
• coldfusion.exe -> cmd.exe
• coldfusion.exe -> powershell.exe
• jrun.exe -> cmd.exe
• jrun.exe -> powershell.exe
• /bin/sh -c
• /bin/bash -c
• curl http://
• wget http://
• certutil -urlcache
• bitsadmin /transfer

What your security team should do

• Treat any vulnerable internet-facing ColdFusion instance as a critical incident candidate due to active exploitation, KEV listing, high exploit probability, and ransomware association.
• Patch or isolate affected systems immediately; the CISA KEV remediation deadline of 2024-01-29 has already passed.
• Prioritize externally reachable ColdFusion servers, systems hosting sensitive applications, and servers with access to databases or internal administrative networks.
• Restrict CFIDE, administrator, adminapi, and diagnostic endpoints to trusted networks and enforce strong administrative authentication.
• Hunt for web shells, suspicious child processes spawned by ColdFusion or Java, abnormal outbound connections, and recent file writes in webroots and CFIDE-related directories.
• Rotate credentials and secrets accessible from the ColdFusion server, including database passwords, API keys, service account credentials, and encryption keys, if exploitation is suspected.
• Preserve web access logs, ColdFusion logs, process execution telemetry, EDR data, and filesystem timelines before rebuilding or cleaning compromised hosts.
• If web shell, command execution, credential theft, or ransomware precursor activity is found, rebuild the server from known-good media rather than relying only on file deletion.