Adobe ColdFusion up to 2021.22/2023.16/2025.4 deserialization

Summaryinfo

A vulnerability, which was classified as problematic, was found in Adobe ColdFusion up to 2021.22/2023.16/2025.4. The impacted element is an unknown function. Such manipulation leads to deserialization. This vulnerability is referenced as CVE-2025-61810. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Adobe ColdFusion up to 2021.22/2023.16/2025.4. Affected by this issue is some unknown functionality. The manipulation with an unknown input leads to a deserialization vulnerability. Using CWE to declare the problem leads to CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Impacted is confidentiality, integrity, and availability. CVE summarizes:

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope is changed.

The advisory is shared for download at helpx.adobe.com. This vulnerability is handled as CVE-2025-61810 since 10/01/2025. The exploitation is known to be easy. The attack may be launched remotely. The exploitation requires an enhanced level of successful authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-202512-1754). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Adobe

Name

• ColdFusion

Version

• 2021.0
• 2021.1
• 2021.2
• 2021.3
• 2021.4
• 2021.5
• 2021.6
• 2021.7
• 2021.8
• 2021.9
• 2021.10
• 2021.11
• 2021.12
• 2021.13
• 2021.14
• 2021.15
• 2021.16
• 2021.17
• 2021.18
• 2021.19
• 2021.20
• 2021.21
• 2021.22
• 2023.0
• 2023.1
• 2023.2
• 2023.3
• 2023.4
• 2023.5
• 2023.6
• 2023.7
• 2023.8
• 2023.9
• 2023.10
• 2023.11
• 2023.12
• 2023.13
• 2023.14
• 2023.15
• 2023.16
• 2025.0
• 2025.1
• 2025.2
• 2025.3
• 2025.4

License

• commercial

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion