Cyber Posture

CVE-2025-61810

High

Published: 10 December 2025

Published
10 December 2025
Modified
12 December 2025
KEV Added
Patch
CVSS Score 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0585 90.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing…

more

maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope is changed.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Timely remediation through vendor patches directly eliminates the deserialization of untrusted data vulnerability in affected ColdFusion versions.

prevent

Validates serialized data inputs from untrusted sources to block malicious payloads that lead to arbitrary code execution.

prevent

Implements memory protections like DEP and ASLR to mitigate the impact of arbitrary code execution resulting from deserialization.

Security SummaryAI

CVE-2025-61810 is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting Adobe ColdFusion versions 2025.4, 2023.16, 2021.22, and earlier versions. The flaw enables arbitrary code execution in the context of the current user when the application processes maliciously crafted serialized data.

A high-privileged attacker (PR:H) with network access (AV:N) can exploit this vulnerability with low attack complexity (AC:L), though it requires user interaction (UI:R). Successful exploitation changes scope (S:C) and results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in the CVSS v3.1 base score of 8.4.

Adobe's security bulletin APSB25-105 provides details on the vulnerability and mitigation, available at https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html.

Details

CWE(s)

Affected Products

adobe
coldfusion
2021, 2023, 2025

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Deserialization of untrusted data in public-facing Adobe ColdFusion enables arbitrary remote code execution, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References