CVE-2018-4939

Timeline

Detection, updates, and resolution for this record.

1. May 19, 2018 · Catalog

   Detected

   Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 3, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

Affected

• cpe adobe/coldfusion11.0
• vendor Adobe ColdFusionversion unspecified

Sources

• CISA KEVCVE-2018-4939

  Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.

  cisa.gov
• CVE.orgCVE-2018-4939

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2018-4939

  30-day exploitation probability 62.0%

  first.org
• NIST NVDCVE-2018-4939

  Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

  nvd.nist.gov

References

• Third Party Advisory · securityfocus.com
• Vendor Advisory · helpx.adobe.com
• CISA note · nvd.nist.gov
• Third Party Advisory · cisa.gov