Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Adobe ColdFusion can run attacker commands remotely

CVE-2016-1114 · published 10 years ago
Summary

Versions of Adobe ColdFusion 10, 11 and 2016 that are missing the latest updates can be tricked into running any command an attacker sends. This happens when specially crafted data is processed by the server, allowing the attacker to take control of the system. Apply the latest Adobe ColdFusion updates or patches immediately to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe coldfusion 10.0
11.0
2016
cpe:2.3:a:adobe:coldfusion:10.0:-:*:*:*:*:*:*
Original advisory text
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache ...
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
9% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published11 May 2016
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2016-1114 · NVD
Track software like this
Free during beta