How severe is CVE-2018-4939?

CVE-2018-4939 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 62.0% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2018-4939: Adobe ColdFusion Deserialization of Untrusted Data

CISA Known Exploited Vulnerabilities

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2021-11-03

Remediation due

2022-05-03

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2018-4939

Description

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

Severity

CVSS 3.1 · CISA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
-	Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions	Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions

References

2 Links

Vulnerability databases

103718

Other references

https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html

Record Details

Published

2018-05-19

Last updated

2025-10-21

Assigner (CNA)

adobe

Credited to

More from Adobe

All Adobe CVEs→

CVE-2023-293009.8 CRITICAL

Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

AdobeKEVEPSS 100.0%2023-07-12

CVE-2018-159619.8 CRITICAL

Adobe ColdFusion Unrestricted File Upload Vulnerability

AdobeKEVEPSS 100.0%2018-09-25

CVE-2023-292987.5 HIGH

Adobe ColdFusion Improper Access Control Security feature bypass

AdobeKEVEPSS 99.8%2023-07-12

CVE-2023-382057.5 HIGH

ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298

AdobeKEVEPSS 99.8%2023-09-14

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.