CVE-2023-29300: Adobe ColdFusion unauthenticated deserialization RCE, actively exploited
The short version: Adobe ColdFusion has a Java deserialization flaw (CVE-2023-29300) that lets an unauthenticated attacker execute arbitrary code on the server. It scores a 9.8, it was exploited in the wild to plant web shells, and it's in CISA's KEV catalog. If you run an affected ColdFusion build, this is patch-and-verify, not patch-and-forget. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.99% · 99.98th percentile (2026-07-17) |
| In CISA KEV? | Yes — added 2024-01-08, remediation was due 2024-01-29 |
| Known exploited? | Yes — used in the wild to deploy web shells |
| Vulnerability type | CWE-502 deserialization of untrusted data → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Adobe ColdFusion 2018 Update 16 and earlier · 2021 Update 6 and earlier · 2023.0.0.330468 and earlier |
| Fixed in | ColdFusion 2018 Update 17 · 2021 Update 7 · 2023 GA build (APSB23-40) — see the note below on the follow-on bypass |
What you need to know
CVE-2023-29300 is a deserialization of untrusted data flaw in ColdFusion's handling of WDDX packets. An unauthenticated attacker sends a crafted request that causes the server to deserialize attacker-controlled data, and the result is arbitrary code execution on the host — no credentials, no user interaction.
In the real world, that meant web shells. Attackers used ColdFusion RCE to drop a shell into the web root and establish persistence, then work outward from there.
- It's pre-authentication and internet-reachable. ColdFusion servers are web application servers, meant to serve traffic — so the attack surface is exactly where attackers already look.
- It's already been used. This isn't theoretical; it's in KEV precisely because it was exploited.
- The patch story is layered. Adobe's initial fix (APSB23-40) used a denylist of Java classes that may not be deserialized. Researchers then found a class outside that denylist that still yielded code execution — tracked separately as CVE-2023-38203. Fully closing the door required the later updates and keeping the ColdFusion JDK/JRE current; an out-of-date JDK can leave the server exploitable even after the ColdFusion update.
How serious we see it
Critical — the 9.8 is not hyperbole here.
Unauthenticated, network-reachable code execution on an internet-facing application server, confirmed exploited in the wild, is top-of-queue by any honest measure. The bounded, reassuring part is that it's narrow and fixable: it affects specific ColdFusion builds, the fixes are published, and you can determine quickly whether you run an affected version. The catch is the usual one for an exploited flaw with a messy patch history — being patched and being clean are separate questions, and the JDK version matters as much as the ColdFusion update.
Recommendations
Straight from Adobe's bulletin (APSB23-40) and CISA:
- Patch now. Update to a fixed ColdFusion build (2018 Update 17 / 2021 Update 7 / the 2023 release build) or later, and apply the subsequent updates that address the CVE-2023-38203 bypass.
- Update the JDK/JRE too. Adobe is explicit: applying the ColdFusion update without updating the ColdFusion JDK/JRE to the current LTS release does not fully secure the server.
- Hunt. Review the web root — especially the
CFIDEdirectory — for unexpected.cfm/.cfcfiles or web shells, and check server logs for anomalous deserialization requests. - If compromised, respond. Remove web shells, rebuild where warranted, and rotate credentials, keys, and secrets reachable from the host.
- Harden exposure. Restrict access to the ColdFusion Administrator, and enforce ColdFusion's IP-allowlist restrictions so the management endpoints aren't reachable from the whole internet.
- Confirm your exposure first. Verify whether you run an affected ColdFusion build at all, and which update level.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing ColdFusion servers, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top of your results because it's in KEV and because unauthenticated RCE earns it. We detect and flag the exposed, affected server; we don't exploit it.
That continuous, attacker's-eye view is the point: when a ColdFusion RCE is being used in the wild, the exposed appliance is already mapped, so you can go straight to patch-and-verify.