CVE-2018-4939

CRITICAL CISA KEV

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

Published: May 19, 2018 Modified: Jun 17, 2026

CWE-502 CWE-502

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (20)

Vendor	Product	Version
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	11.0
adobe	coldfusion	2016
adobe	coldfusion	2016
adobe	coldfusion	2016
adobe	coldfusion	2016
adobe	coldfusion	2016
adobe	coldfusion	2016

GitHub Security Advisory GHSA-p86w-qv2x-rf6j

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have...

References (5)

http://www.securityfocus.com/bid/103718 Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html Vendor Advisory
http://www.securityfocus.com/bid/103718 Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4939 Third Party Advisory, US Government Resource

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 62.91%

Top 1% most likely to be exploited

Threat Score 88.1 / 100

CISA Known Exploited

Date Added: 2021-11-03

Due Date: 2022-05-03

Required Action:

Apply updates per vendor instructions.

Data Sources

NVD CISA KEV EPSS GitHub