CVE-2018-4939

State: Published
Severity: 9.8 Critical
Published: May 19, 2018
Updated: Oct 21, 2025
Reserved: Jan 3, 2018

Description

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versionsn/a	Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versionsAffected

References

https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html
103718vdb-entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4939government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.