Live › vulnerability › CVE-2018-4939
Go to dashboardAdobe ColdFusion deserializes untrusted data without checks, letting a crafted request run code on the server. An attacker who reaches the server gets code execution there, and CISA lists it as exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Adobe ColdFusion | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply the Adobe ColdFusion updates for this CVE per vendor instructions; exact fixed build numbers are not in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.
This page as .md · .json · in your agent: get_signal("CVE-2018-4939")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.