Login Sign Up

CVE-2023-38203

9.8 CRITICAL
Remote Code Execution Deserialization

📋 TL;DR

CVE-2023-38203 is a critical deserialization vulnerability in Adobe ColdFusion that allows attackers to execute arbitrary code without user interaction. This affects ColdFusion 2018, 2021, and 2023 versions before specific updates. Attackers can exploit this to take complete control of affected servers.

💻 Affected Systems

Products:
  • Adobe ColdFusion
Versions: ColdFusion 2018 Update 17 and earlier, 2021 Update 7 and earlier, 2023 Update 1 and earlier
Operating Systems: All supported platforms (Windows, Linux, macOS)
Default Config Vulnerable: ⚠️ Yes
Notes: All ColdFusion installations within affected version ranges are vulnerable regardless of configuration.

📦 What is this software?

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with attacker gaining full administrative control, data exfiltration, ransomware deployment, and lateral movement within the network.

🟠

Likely Case

Remote code execution leading to web shell installation, credential theft, and initial access for further attacks.

🟢

If Mitigated

Limited impact if proper network segmentation, WAF rules, and least privilege principles are implemented.

🌐 Internet-Facing: HIGH - Exploitation requires no authentication and can be triggered remotely via HTTP requests.
🏢 Internal Only: HIGH - Internal systems remain vulnerable to authenticated attackers or compromised internal hosts.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: CONFIRMED
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

CISA has added this to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: ColdFusion 2018 Update 18, 2021 Update 8, 2023 Update 2

Vendor Advisory: https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html

Restart Required: Yes

Instructions:

1. Download appropriate update from Adobe ColdFusion downloads page. 2. Backup current installation. 3. Apply update using ColdFusion installer. 4. Restart ColdFusion services.

🔧 Temporary Workarounds

Network-based mitigation

all

Implement WAF rules to block suspicious deserialization patterns and restrict access to ColdFusion administration interfaces.

Access control restrictions

all

Limit network access to ColdFusion servers to only trusted IP addresses and implement strict firewall rules.

🧯 If You Can't Patch

  • Isolate affected systems in a separate network segment with strict access controls
  • Implement application-level monitoring and alerting for suspicious deserialization activity

🔍 How to Verify

Check if Vulnerable:

Check ColdFusion version via ColdFusion Administrator interface or cfusion/lib/version.txt file

Check Version:

On Windows: type "C:\ColdFusion\cfusion\lib\version.txt" | On Linux: cat /opt/coldfusion/cfusion/lib/version.txt

Verify Fix Applied:

Verify version is updated to 2018u18, 2021u8, or 2023u2 or later

📡 Detection & Monitoring

Log Indicators:

  • Unusual Java deserialization errors in application logs
  • Suspicious HTTP requests to ColdFusion endpoints
  • Unexpected process creation from ColdFusion services

Network Indicators:

  • HTTP requests containing serialized Java objects to ColdFusion ports (typically 8500, 80, 443)
  • Outbound connections from ColdFusion servers to unknown external IPs

SIEM Query:

source="coldfusion.log" AND ("deserialization" OR "java.io" OR suspicious HTTP patterns)

📊 Metadata

CVE ID: CVE-2023-38203
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-502
Published: July 20, 2023
Last Updated: October 23, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-38203, you might also want to check these:

CVE-2023-46604 10.0

CVE-2023-46604 is a critical remote code execution vulnerability in Apache ActiveMQ's Java OpenWire ...

Same vulnerability type (CWE-502)
CVE-2023-49772 10.0

This vulnerability allows unauthenticated attackers to execute arbitrary PHP code through deserializ...

Same vulnerability type (CWE-502)
CVE-2024-25100 10.0

This vulnerability allows unauthenticated attackers to inject malicious PHP objects via deserializat...

Same vulnerability type (CWE-502)