CVE-2017-3066 - Adobe ColdFusion Deserialization Vulnerability

Adobe | ColdFusion

• Date Added:
• 2025-02-24

• Due Date:
• 2025-03-17

Vulnerability Name

Adobe ColdFusion Deserialization Vulnerability

Description

Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html ; https://nvd.nist.gov/vuln/detail/CVE-2017-3066

Top Security News

New NailaoLocker ransomware used against EU healthcare orgs

Black Basta ransomware gang's internal chat logs leak online

Chinese hackers abuse Microsoft APP-v tool to evade antivirus

Cisco Confirms Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks

Windows Server 2025 released—here are the new features

SonicWall firewall bug leveraged in attacks after PoC exploit release

Data Leak Exposes TopSec's Role in China's Censorship-as-a-Service Operations

CISA Flags Craft CMS Vulnerability CVE-2025-23209 Amid Active Attacks

Common Alerts

LowSecure Pages Include Mixed Content

InformationalStorable but Non-Cacheable Content

LowInformation Disclosure - Debug Error Messages

HighLog4Shell (CVE-2021-44228)

InformationalSec-Fetch-Site Header is Missing

MediumBuffer Overflow

HighLDAP Injection

HighSQL Injection

LowX-Content-Type-Options Header Missing

LowInsufficient Site Isolation Against Spectre Vulnerability

Top CVE List

CVE-2025-0111 Palo Alto Networks PAN-OS File Read Vulnerability

CVE-2024-41710 Mitel SIP Phones Argument Injection Vulnerability

CVE-2025-0108 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

CVE-2017-3881 Cisco IOS and IOS XE Remote Code Execution Vulnerability

CVE-2017-6736 Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

CVE-2025-24989 Microsoft Power Pages Improper Access Control Vulnerability

CVE-2024-40891 Zyxel DSL CPE OS Command Injection Vulnerability

CVE-2017-0148 Microsoft SMBv1 Server Remote Code Execution Vulnerability

CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability

CVE-2025-0994 Trimble Cityworks Deserialization Vulnerability

Common CWEs

CWE-826 Premature Release of Resource During Expected Lifetime

CWE-636 Not Failing Securely ('Failing Open')

CWE-1324 DEPRECATED: Sensitive Information Accessible by Physical Probing of JTAG Interface

CWE-138 Improper Neutralization of Special Elements

CWE-278 Insecure Preserved Inherited Permissions

CWE-1289 Improper Validation of Unsafe Equivalence in Input

CWE-1253 Incorrect Selection of Fuse Values

CWE-24 Path Traversal: '../filedir'

CWE-842 Placement of User into Incorrect Group

LowCWE-779 Logging of Excessive Data