CVE-2023-44353

What it actually does

Adobe ColdFusion 2023 Update 5 and earlier and ColdFusion 2021 Update 11 and earlier contain an unauthenticated deserialization-of-untrusted-data vulnerability. A remote attacker can send crafted serialized input to an exposed ColdFusion service and cause the application server to deserialize attacker-controlled objects, leading to arbitrary code execution in the context of the ColdFusion service account. Because the CVSS vector is network-accessible, low-complexity, requires no privileges, and requires no user interaction, successful exploitation can provide full confidentiality, integrity, and availability impact on the ColdFusion server and potentially adjacent systems reachable from it.

Why it matters to the business

A vulnerable internet-facing ColdFusion server can be taken over remotely without a valid login, allowing attackers to steal application data and credentials, modify hosted applications, deploy web shells, pivot into internal networks, or disrupt business services. The EPSS score is high and exploit maturity is weaponized, so organizations running affected versions should treat exposure as urgent even though this CVE is not currently listed in CISA KEV and is not specifically marked as ransomware-used.

How an attack unfolds

An attacker first identifies a ColdFusion deployment by probing HTTP headers, default ColdFusion paths, error pages, or known application behavior. They then send a crafted request containing malicious serialized data to a vulnerable ColdFusion component or endpoint that performs unsafe deserialization. When ColdFusion processes the request, attacker-controlled object data is instantiated and triggers code execution inside the ColdFusion Java process. The attacker typically validates execution with a benign command, then runs operating-system commands to download tools, write a web shell, create persistence, harvest configuration files and secrets, or use the server as a foothold for lateral movement. Post-exploitation activity often appears as abnormal child processes spawned by the ColdFusion Java runtime, suspicious outbound connections, unexpected files under web-accessible ColdFusion directories, or modified application templates.

How to fix it

Upgrade affected Adobe ColdFusion installations to a fixed release: ColdFusion 2023 Update 6 or later, or ColdFusion 2021 Update 12 or later. If a later cumulative update is available from Adobe, install the latest update rather than the minimum fixed version. After patching, restart ColdFusion services and verify the reported update level. Restrict public access to ColdFusion Administrator and other management interfaces, allow access only from trusted administrative networks, and place ColdFusion behind a properly configured reverse proxy or WAF where appropriate. Remove unused ColdFusion components, sample applications, and default files. Run the ColdFusion service with least privilege, rotate secrets stored on the server if compromise is suspected, and review any custom code paths that deserialize user-controlled data. If immediate patching is not possible, reduce exposure by blocking untrusted access to ColdFusion endpoints, disabling unnecessary services and modules, and enforcing network-level access controls; these mitigations should be considered temporary and not a substitute for upgrading.

How to confirm the fix worked

Confirm the installed ColdFusion update level from the ColdFusion Administrator, Adobe update tooling, or product version files and verify it is newer than the affected versions: later than 2023 Update 5 or later than 2021 Update 11. Validate that ColdFusion Administrator and management endpoints are not reachable from untrusted networks. Perform authenticated configuration review to ensure the latest Adobe security updates are applied and that the ColdFusion service has restarted after patching. Use vulnerability scanning or safe version-detection checks to confirm the exposed service no longer reports an affected build. Review web server access logs and ColdFusion logs before and after remediation to confirm exploit attempts are no longer reaching vulnerable endpoints. Where possible, test compensating controls by confirming suspicious serialized payloads or requests containing Java serialization markers are blocked or logged by the WAF/reverse proxy.

Typical attack path

1. Identify an exposed Adobe ColdFusion instance through internet scanning, banner detection, default paths, or application responses.
2. Confirm the instance is running ColdFusion 2023 Update 5 or earlier, or ColdFusion 2021 Update 11 or earlier, or infer vulnerability from patch level and behavior.
3. Send a crafted unauthenticated HTTP request containing malicious serialized data to the vulnerable ColdFusion deserialization surface.
4. Trigger deserialization inside the ColdFusion Java process and execute attacker-supplied code with the privileges of the ColdFusion service account.
5. Run reconnaissance commands such as whoami, hostname, ipconfig/ifconfig, environment-variable collection, or directory listing.
6. Deploy a web shell, command stager, remote access tool, cryptominer, or other payload; alternatively, modify ColdFusion application files for persistence.
7. Collect ColdFusion configuration, datasource credentials, application secrets, logs, and files accessible to the service account.
8. Use stolen credentials or network access from the ColdFusion host to pivot into databases, file shares, identity systems, or other internal services.

How to detect it

Review historical web server, reverse proxy, WAF, and ColdFusion logs for suspicious unauthenticated POST requests, serialized Java payload markers, unusually large or encoded parameters, repeated 500 errors, and requests to ColdFusion administrative or component endpoints from unknown sources. Inspect ColdFusion logs such as application.log, exception.log, server.log, coldfusion-out.log, coldfusion-error.log, and web server access logs for deserialization exceptions or abnormal request patterns. On hosts, examine process telemetry for child processes launched by the ColdFusion Java runtime, especially cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, curl, wget, bash, sh, python, perl, nc, or netcat. Hunt for recently created or modified web-accessible files under ColdFusion webroots, CFIDE-related directories, application deployment directories, and temporary directories. Review outbound network connections from the ColdFusion host to unfamiliar IPs, newly contacted domains, paste sites, file-sharing services, VPS providers, or command-and-control infrastructure. Check for credential access by reviewing reads of ColdFusion configuration files, datasource definitions, keystores, and application property files. If EDR is available, pivot on java.exe or the ColdFusion service process performing command execution, file writes to webroots, archive creation, credential dumping, or unexpected network downloads.

• java.io.StreamCorruptedException
• java.io.InvalidClassException
• java.io.ObjectInputStream
• deserializ
• aced0005
• rO0AB
• /CFIDE/administrator/
• /CFIDE/adminapi/
• /cf_scripts/
• /WEB-INF/cfusion/
• cfusion/logs/exception.log
• cfusion/logs/application.log
• cfusion/logs/server.log
• cfusion/logs/coldfusion-out.log
• cfusion/logs/coldfusion-error.log
• java.exe -> cmd.exe
• java.exe -> powershell.exe
• java.exe -> certutil.exe
• java.exe -> bitsadmin.exe
• java.exe -> curl.exe
• java.exe -> wget.exe
• java -> /bin/sh
• java -> /bin/bash
• .cfm?cmd=
• cmd.exe /c whoami
• powershell -enc
• certutil -urlcache -split -f
• bitsadmin /transfer
• wget http
• curl http
• nc -e
• /tmp/.
• /var/tmp/.

What your security team should do

• Immediately inventory all Adobe ColdFusion deployments, including internet-facing, partner-facing, development, and legacy servers.
• Prioritize patching any exposed ColdFusion 2023 Update 5 or earlier and ColdFusion 2021 Update 11 or earlier systems to the latest available Adobe update.
• If the server is internet-accessible, assume active probing is likely because exploitation is weaponized and EPSS is high; review logs for exploitation attempts and signs of compromise.
• Restrict ColdFusion Administrator and management interfaces to trusted administrative networks only; do not expose them directly to the internet.
• Hunt for abnormal child processes spawned by the ColdFusion Java process, including command shells, scripting engines, download utilities, archiving tools, and network tools.
• Search ColdFusion webroots and application directories for recently created or modified .cfm, .cfc, .jsp, .jspx, .war, .jar, or executable files.
• Rotate application secrets, datasource credentials, API keys, and service account credentials if exploitation is suspected or confirmed.
• Enable or tune WAF, EDR, and SIEM detections for Java deserialization payloads, suspicious ColdFusion requests, and ColdFusion-spawned command execution.
• Preserve logs and forensic artifacts before rebuilding or cleaning suspected compromised hosts.
• For high-risk or compromised systems, rebuild from trusted media after patching and restore only verified-clean application content.