CVE-2023-44351

What it actually does

Adobe ColdFusion 2023 Update 5 and earlier and ColdFusion 2021 Update 11 and earlier contain a deserialization of untrusted data vulnerability. A remote, unauthenticated attacker can send crafted data to a vulnerable ColdFusion service and cause the server-side Java runtime to deserialize attacker-controlled objects. Successful exploitation can result in arbitrary code execution in the security context of the ColdFusion service account, enabling full compromise of the ColdFusion application tier, including reading or modifying application files, accessing secrets available to the process, pivoting to connected databases or internal services, and disrupting service availability.

Why it matters to the business

This is a critical, network-exploitable server-side flaw that requires no user interaction or authentication. A compromised ColdFusion server can expose sensitive application data, enable website or application tampering, provide a foothold into internal networks, and cause outages for business applications hosted on ColdFusion. Although it is not currently listed in CISA KEV and the provided exploit maturity is not mature, the EPSS score is elevated, indicating meaningful likelihood of exploitation activity over time; internet-facing ColdFusion systems should be treated as high-priority remediation targets.

How an attack unfolds

An attacker first identifies an Adobe ColdFusion instance exposed to the network and determines whether it is running an affected release. The attacker then sends a specially crafted request containing malicious serialized data to functionality that processes untrusted input. When the vulnerable server deserializes that data, attacker-controlled object behavior can execute within the ColdFusion Java process. From there, the attacker may run operating system commands, deploy a web shell or backdoor, read configuration files, harvest application credentials, access connected data stores, modify application content, or use the compromised server as a pivot point. Post-exploitation activity commonly focuses on persistence, credential theft, reconnaissance of adjacent systems, and cleanup or log tampering to reduce visibility.

How to fix it

Upgrade Adobe ColdFusion to a fixed release immediately. For the affected branches described, update ColdFusion 2023 to Update 6 or later and ColdFusion 2021 to Update 12 or later, or apply the latest available Adobe ColdFusion security update for the deployed major version. If immediate patching is not possible, restrict access to ColdFusion administrative and sensitive endpoints, place the service behind a WAF or reverse proxy with strict allowlisting where feasible, block unnecessary internet exposure, disable unused ColdFusion components and services, run ColdFusion with least-privilege service accounts, and monitor aggressively for exploitation attempts. Because successful exploitation may lead to full server compromise, systems that show signs of exploitation should be rebuilt or restored from known-good media after forensic preservation, and credentials, API keys, database passwords, and service secrets accessible to the ColdFusion process should be rotated.

How to confirm the fix worked

Confirm the installed ColdFusion update level from the ColdFusion Administrator, Adobe package/update tooling, or server filesystem metadata and verify it is no longer ColdFusion 2023 Update 5 or earlier, or ColdFusion 2021 Update 11 or earlier. Validate that the latest Adobe ColdFusion security update is installed on every ColdFusion instance, including non-production, standby, and disaster-recovery systems. Run authenticated vulnerability scanning or configuration assessment to confirm the patched build. Review external attack surface results to ensure ColdFusion is not unnecessarily exposed to the internet. After patching, test application functionality, confirm ColdFusion services restarted successfully, and verify that WAF or reverse-proxy controls do not interfere with legitimate application traffic. If exploitation is suspected, do not rely on patch validation alone; perform host, application, and log review for post-exploitation artifacts.

Typical attack path

1. Scan for internet-facing Adobe ColdFusion servers or identify ColdFusion through headers, paths, error pages, or application behavior.
2. Fingerprint the ColdFusion version or infer exposure based on patch level and reachable ColdFusion endpoints.
3. Send a crafted unauthenticated request containing malicious serialized data to trigger unsafe deserialization.
4. Achieve code execution under the ColdFusion service account.
5. Run reconnaissance commands and inspect ColdFusion configuration, application source, scheduled tasks, and environment variables for secrets.
6. Deploy persistence such as a web shell, modified ColdFusion template, startup task, or additional remote-access payload.
7. Use stolen credentials or network access to reach databases, file shares, identity systems, or other internal services.
8. Exfiltrate data, alter hosted applications, disrupt service, or use the server for further attacks.

How to detect it

To determine whether exploitation already occurred, review Adobe ColdFusion logs, web server access logs, reverse-proxy/WAF logs, EDR telemetry, operating system event logs, file integrity monitoring, and network egress records. Focus on the period before patching and any time the server was internet-accessible while running an affected update level. In ColdFusion logs, look for deserialization-related Java exceptions, unexpected stack traces, repeated malformed requests, and errors immediately followed by process execution or file creation. In web access logs, look for unusual requests to ColdFusion endpoints, suspicious POST bodies, requests with binary or serialized-looking payloads, unexpected access to CFIDE or administrator paths, and attempts to retrieve newly created .cfm, .cfc, .jsp, or script files. On the host, look for the ColdFusion Java process spawning command interpreters, PowerShell, curl, wget, certutil, bash, sh, python, perl, or archive utilities. Review recently modified files under ColdFusion web roots and CFIDE directories, especially small or obfuscated templates that execute request parameters. Check for outbound connections from the ColdFusion process to unfamiliar IPs, unusual DNS lookups, scheduled tasks or services created around suspicious request times, new local users, modified startup scripts, and credential or configuration file access. Because no single public IOC is universal for this vulnerability, combine version exposure, suspicious request patterns, Java deserialization errors, unexpected child processes, and new web-accessible files to assess compromise.

• java.io.InvalidClassException
• java.io.StreamCorruptedException
• java.io.OptionalDataException
• java.io.WriteAbortedException
• java.io.NotSerializableException
• ObjectInputStream
• readObject
• deserialization
• cfusion/logs/application.log
• cfusion/logs/exception.log
• cfusion/logs/coldfusion-out.log
• cfusion/logs/coldfusion-error.log
• cfusion/runtime/logs/application.log
• cfusion/runtime/logs/exception.log
• cfusion/wwwroot/CFIDE/
• /CFIDE/administrator/
• /CFIDE/adminapi/
• /CFIDE/componentutils/
• coldfusion.exe -> cmd.exe
• coldfusion.exe -> powershell.exe
• coldfusion.exe -> certutil.exe
• coldfusion.exe -> curl.exe
• coldfusion.exe -> wget.exe
• java.exe -> cmd.exe
• java.exe -> powershell.exe
• java.exe -> bash
• java.exe -> sh
• .cfm.jsp
• .jsp;.cfm
• <cfexecute
• Runtime.getRuntime().exec
• ProcessBuilder(

What your security team should do

• Inventory all Adobe ColdFusion servers, including development, staging, legacy, and disaster-recovery instances.
• Prioritize patching internet-facing ColdFusion systems first; update ColdFusion 2023 to Update 6 or later and ColdFusion 2021 to Update 12 or later, preferably to the latest available security update.
• Restrict direct internet access to ColdFusion Administrator and other sensitive ColdFusion endpoints using network ACLs, VPN, identity-aware proxying, or allowlists.
• Review ColdFusion and web server logs for suspicious unauthenticated requests, deserialization errors, web shell activity, and unusual administrative access before and after patching.
• Hunt for unexpected files in ColdFusion web roots, CFIDE paths, uploaded-file directories, and recently modified .cfm, .cfc, .jsp, .jar, .class, and script files.
• Monitor the ColdFusion Java process for child process creation, outbound network connections, credential access, archive creation, and file staging behavior.
• Rotate credentials and secrets accessible to ColdFusion if exploitation cannot be confidently ruled out.
• Ensure ColdFusion runs under a dedicated least-privilege account with limited filesystem, database, and network permissions.
• Add compensating WAF and EDR detections for suspicious serialized payloads, ColdFusion web shell patterns, and Java process command execution.
• Preserve logs and forensic artifacts from potentially exposed servers because exploitation can be difficult to prove after cleanup or log rotation.