CVE-2017-3066: Adobe ColdFusion Deserialization Vulnerability
Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.
Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
What it is
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
Description quoted from the CVE record (assigned by adobe, published 2017-04-27).
Weakness: CWE-502 Deserialization of Untrusted Data
How it can be exploited
Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA assessment (SSVC): CISA assesses exploitation as active. Automatable: yes. Technical impact: total.
- On CISA KEV since
- 2025-02-24
- US federal deadline
- 2025-03-17
- Ransomware use
- Not known
Public exploit evidence (Exploit Observer)
Also known as: BDU:2017-01194, CNNVD-201704-1418, CNVD-2017-06457, EDB-43993, EUVD-2017-12207, GHSA-7cc9-8vjg-gpp8
VEDAS cluster: VEDAS:BOLDMOONBEAM
Exploit Observer links 5 pieces of public exploit code or detection modules that name this CVE or one of its aliases.
Exploit code and modules (5)
Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.
- Exploit-DB: https://www.exploit-db.com/raw/43993
- Code repository: https://github.com/cucadili/cve-2017-3066
- Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2017/CVE-2017-3066.rules
- Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2017/CVE-2017-3066.rules
- Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2017/CVE-2017-3066.rules
Vulnerability databases and vendor advisories (6)
Catalogue entries, not exploit evidence.
- Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2017-12207
- Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-7cc9-8vjg-gpp8
- Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2017-3066
- Vulnerability database or vendor advisory: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3066
- Vulnerability database or vendor advisory: https://www.cnnvd.org.cn/home/globalSearch?keyword=CNNVD-201704-1418
- Vulnerability database or vendor advisory: https://www.cnvd.org.cn/flaw/show/CNVD-2017-06457
33 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.
VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.
Live scores
- EPSS
- 0.906
very likely to be attacked soon - VEDAS
- 0.983
strong exploit evidence - On CISA KEV
- Yes, since 2025-02-24
- Detection rule
- Suricata
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Who is affected
| Product | Affected | Not affected |
|---|---|---|
| Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier | version Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier | Not stated |
Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.
Exploit Observer also maps it to: adobe coldfusion, adobe_systems_inc. coldfusion.
How to fix it
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor guidance:
- https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-3066
How to detect it
Suricata rules (network detection)
1 rule that alert on traffic matching this exploit: VEDAS CVE-2017-3066 Adobe ColdFusion BlazeDS - Deserialization RCE Attempt. Add them to your Suricata rule set and reload.
Show the rules
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2017-3066 Adobe ColdFusion BlazeDS - Deserialization RCE Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/flex2gateway"; nocase; fast_pattern; http.request_body; content:"|ac ed 00 05|"; classtype:attempted-admin; reference:cve,CVE-2017-3066; reference:url,https://www.exploit.observer/?keyword=CVE-2017-3066&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=coldfusion&match=exact; sid:1050601; rev:1;)
References
Exploits and technical analysis
- 43993 (exploit, x_refsource_EXPLOIT-DB)
Government sources
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3066 (government-resource)
Other references
- https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html (x_refsource_CONFIRM)
- 98003 (vdb-entry, x_refsource_BID)
- 1038364 (vdb-entry, x_refsource_SECTRACK)
Other databases
Where this comes from
This advisory is generated automatically by VEDAS from: CVE.org record, CISA KEV, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.