Adobe ColdFusion - RCE (CVE-2017-3066)
Description
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
psychologyCrowdSec Analysis
CVE-2017-3066 is a critical Java deserialization vulnerability in the Apache BlazeDS library used by Adobe ColdFusion, which allows attackers to execute arbitrary code on vulnerable servers.
CrowdSec has been tracking this vulnerability and its exploits since 28th of June 2024.
CrowdSec has not observed any significant exploitation activity targeting CVE-2017-3066 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attack attempts typically leverage requests to URLs containing /flex2gateway/amf.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2017-04-27 |
| Rule Released | 2024-06-28 |
| CISA KEV | 2025-02-24 |
| CrowdSec First Seen | 2025-02-28 |
| CISA Remediation Deadline | 2025-03-17 |