Adobe ColdFusion Deserialization Vulnerability (CVE-2017-3066)

What is affected, what to do

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier eq Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier..Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every ColdFusion instance (10, 11, 2016), including forgotten test and legacy hosts. Check the update level in ColdFusion Administrator under "System Information" or in cfusion/lib/updates/. Vulnerable releases are ColdFusion 2016 up to Update 3, ColdFusion 11 up to Update 11, and ColdFusion 10 up to Update 22.
   • Patch: The fix ships in ColdFusion 2016 Update 4, ColdFusion 11 Update 12 and ColdFusion 10 Update 23. Look up the exact bulletin reference in the Adobe security bulletin. All three major versions are out of vendor support, so schedule migration to a supported, fully updated ColdFusion release in parallel.
   • Block the endpoint if you cannot patch right away: Block the BlazeDS/AMF endpoint /flex2gateway/ (including /flex2gateway/amf*) at the reverse proxy, WAF or load balancer for internet-sourced traffic. Pull exposed instances off the internet or restrict them to VPN or allowlisted access. This covers 80/443 and the built-in web server on 8500.
   • Compromise check: Hunt for unknown .cfm, .cfc and .jsp files in wwwroot, CFIDE and WEB-INF modified since exposure. Review new scheduled tasks in ColdFusion Administrator and any new local accounts.
   • Rotate secrets if compromise is suspected: This includes datasource passwords (stored in neo-datasource.xml and recoverable locally), the admin password, the RDS password and service-account credentials. If compromise is suspected, isolate the host and preserve evidence (JVM memory dump, logs).
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration: If Flash Remoting/Flex is not used (almost always the case today), comment out the MessageBrokerServlet mappings for /flex2gateway/* in cfusion/wwwroot/WEB-INF/web.xml and restart the service. Also apply the vendor lockdown guidance: keep /CFIDE/administrator off public interfaces and disable RDS.
   • WAF/IPS: Block external requests carrying Content-Type: application/x-amf or targeting /flex2gateway. Additionally inspect bodies for Java gadget markers such as ac ed 00 05, sun.rmi.server.UnicastRef, org.apache.commons.collections, java.rmi.registry or other ysoserial class names. Enable the Suricata/ET "ColdFusion AMF Deserialization" signatures and confirm they are current.
   • Segmentation and egress filtering: The ColdFusion server should not initiate connections to the internet. This matters most for JRMP/RMI (commonly 1099 or arbitrary high ports), because popular exploit chains trigger a JRMP callback to attacker infrastructure. Allow outbound traffic only to databases and defined update targets.
   • Endpoint hardening: Run the ColdFusion service under a dedicated low-privilege account, never LocalSystem or root. Remove the service account's write access to webroot directories. Use EDR or AppLocker rules to block shell execution by coldfusion.exe or java(w).exe from the ColdFusion path.
   • IAM/least privilege: Scope datasource DB accounts to minimal rights, with no DBA or xp_cmdshell rights. This limits lateral movement after code execution.
3. 03

   Runbook step 3

   Detection rules

   • Web server and proxy logs: Watch for POSTs to /flex2gateway/ from external IPs, especially with unusual body sizes or previously unseen sources. Example SPL: index=web uri_path="/flex2gateway*" http_method=POST NOT src_ip IN (internal) | stats count by src_ip, uri_path, status.
   • EDR process ancestry (Sysmon EID 1 / Windows 4688): Flag coldfusion.exe, jrun.exe or java.exe (path *\ColdFusion*\) spawning cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe or whoami.exe. On Linux, look for java → sh/bash/curl/wget (auditd execve with the CF process as ppid). Sigma shape: ParentImage|contains: 'ColdFusion' AND Image|endswith: ['\cmd.exe','\powershell.exe'].
   • File system (Sysmon EID 11 / auditd watch on webroot): New .cfm, .jsp or .cfc files written by the CF service process into wwwroot, CFIDE or WEB-INF indicate a dropped webshell.
   • Network telemetry (Zeek/Suricata, Sysmon EID 3): Look for outbound TCP from the ColdFusion host to public addresses, particularly JRMP/RMI handshakes (JRMI magic bytes 4a 52 4d 49) or DNS lookups immediately after an AMF POST. Example KQL: DeviceNetworkEvents | where InitiatingProcessFolderPath has "ColdFusion" and RemoteIPType == "Public".
   • Application logs: Search cfusion/logs/exception.log and coldfusion-error.log for stack traces containing flex.messaging, ClassNotFoundException or InvalidClassException around AMF requests. These are typical artefacts of gadget attempts, whether failed or successful.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Adobe Adobe ColdFusion

Weakness classes (CWE)

• CWE-502Deserialization of Untrusted Data

  Base

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  Entry at MITRE CWE-502

References & sources

• exploit-db.com43993Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• helpx.adobe.comAdobe advisory: Adobe ColdFusionx_refsource_CONFIRM, Patch, Vendor advisory, pwn-watch
• securityfocus.com98003Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
• securitytracker.com1038364Vulnerability database, x_refsource_SECTRACK, Broken link, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3066government-resource, US government resource
• pwn.watchpwn.watch: Adobe ColdFusion: ColdFusion Deserialization Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2017-3066pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch