CVE-2023-38203

Timeline

Detection, updates, and resolution for this record.

1. Jul 20, 2023 · Catalog

   Detected

   Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

2. Jan 8, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Jan 29, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

Affected

• cpe adobe/coldfusion2018
• vendor Adobe ColdFusionversion unspecified

Sources

• CISA KEVCVE-2023-38203

  Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.

  cisa.gov
• CVE.orgCVE-2023-38203

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2023-38203

  30-day exploitation probability 97.1%

  first.org
• NIST NVDCVE-2023-38203

  Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

  nvd.nist.gov

References

• CISA note · helpx.adobe.com
• CISA note · nvd.nist.gov
• Third Party Advisory · cisa.gov