BaseFortify

Publication date: 2025-12-10

Last updated on: 2025-12-12

Assigner: Adobe Systems Incorporated

Description

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-10

Last Modified

2025-12-12

Generated

2026-07-06

AI Q&A

2025-12-10

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61810

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	coldfusion	2021.22
adobe	coldfusion	2023.16
adobe	coldfusion	2025.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a Deserialization of Untrusted Data issue in certain versions of ColdFusion. It occurs when the application processes maliciously crafted serialized data provided by an attacker, which can lead to arbitrary code execution within the context of the current user. Exploitation requires user interaction and involves a change in scope.

Impact Analysis

If exploited, this vulnerability can allow a high privileged attacker to execute arbitrary code on the affected system, potentially leading to full compromise of the application and its data. This can result in data loss, unauthorized access, and disruption of services.

Hi! I’m here to help you understand CVE-2025-61810. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70