CVE-2025-24447: Critical Deserialization Flaw in Adobe ColdFusion

CVE-2025-24447 is a critical deserialization of untrusted data flaw (CVSS 9.1) in Adobe ColdFusion 2023.12, 2021.18, 2025.0 and earlier, with code execution as the stated result. No user interaction or listed privileges are needed. Adobe fixed it in bulletin APSB25-15, so install those updates promptly.

What's affected

The NVD record names Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. Anything at or below those levels is affected. The description says code can run in the context of the current user, with high impact on confidentiality and integrity, and that exploitation needs no user interaction. The vector shows network access and no privileges required, which puts it in a more urgent bucket than its admin only sibling.

The record is not on the CISA Known Exploited Vulnerabilities list.

The weakness is classed as CWE-502 (deserialization of untrusted data). The score is 9.1 (CRITICAL). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is high on confidentiality, high on integrity and no on availability. The record was published on 2025-04-08.

The record points to Adobe security bulletin APSB25-15 and gives no fixed version itself. I could not retrieve that page, so open it and read the update numbers for your line, which will be later than the versions above. Install the latest update for your major version.

How to check if you're exposed

ColdFusion reports its own update level, so the check is straightforward.

1. Open the ColdFusion Administrator and read the server version and update level on its dashboard or system information page.
2. Compare it with 2023.12, 2021.18 and 2025.0, which are the highest affected levels in the record, and with the fixed numbers in APSB25-15.
3. Check who can reach the Administrator. It should be limited to a management network, a VPN or a short IP allowlist.
4. Review the Administrator user list for accounts that are shared, stale or not needed.
5. In the web server or load balancer configuration, confirm the admin path is not published to the internet.

Also check lock down guidance in Adobe's documentation for your version.

What to do now

1. Read APSB25-15 and note the fixed update for each ColdFusion line you run.
2. Apply the update in a test environment, then in production, and restart the service as the notes require.
3. Restrict the ColdFusion Administrator to a management network or VPN.
4. Remove unused admin accounts and set unique strong passwords.
5. Review server logs for unexpected admin activity from before the update.

Why it matters

Deserialization of untrusted data, listed as CWE-502, happens when a program rebuilds objects from bytes that an outsider supplied. If the format allows the data to choose which classes get built or which code runs while it is read, an attacker can steer the program in ways its authors did not plan. Java based servers such as ColdFusion have a long record of problems in this class.

The usual defences are patching, restricting which classes may be deserialized, and not exposing endpoints that accept such data to untrusted callers. Reachability matters too: whether a given server actually exposes the vulnerable path decides how much of the score applies to you.

If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-24447
• NVD record data for CVE-2025-24447 (published 2025-04-08)
• Adobe security bulletin APSB25-15 (listed in the record, could not be retrieved)

Last reviewed: 19 October 2026.