CVE-2025-61810
Published: 10 December 2025
Description
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing…
more
maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope is changed.
Mitigating Controls (NIST 800-53 r5)AI
Timely remediation through vendor patches directly eliminates the deserialization of untrusted data vulnerability in affected ColdFusion versions.
Validates serialized data inputs from untrusted sources to block malicious payloads that lead to arbitrary code execution.
Implements memory protections like DEP and ASLR to mitigate the impact of arbitrary code execution resulting from deserialization.
Security SummaryAI
CVE-2025-61810 is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting Adobe ColdFusion versions 2025.4, 2023.16, 2021.22, and earlier versions. The flaw enables arbitrary code execution in the context of the current user when the application processes maliciously crafted serialized data.
A high-privileged attacker (PR:H) with network access (AV:N) can exploit this vulnerability with low attack complexity (AC:L), though it requires user interaction (UI:R). Successful exploitation changes scope (S:C) and results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in the CVSS v3.1 base score of 8.4.
Adobe's security bulletin APSB25-105 provides details on the vulnerability and mitigation, available at https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization of untrusted data in public-facing Adobe ColdFusion enables arbitrary remote code execution, directly mapping to exploitation of public-facing applications.