# CVE-2017-3066: Adobe ColdFusion - RCE

> Live exploitation tracking for CVE-2017-3066 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2017-3066

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Adobe ColdFusion
- **Weaknesses:** CWE-502 (Deserialization of Untrusted Data)

## Description

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

## CrowdSec analysis

[CVE-2017-3066](https://euvd.enisa.europa.eu/vulnerability/CVE-2017-3066) is a critical Java deserialization vulnerability in the Apache BlazeDS library used by Adobe ColdFusion, which allows attackers to execute arbitrary code on vulnerable servers.

CrowdSec has been tracking this vulnerability and its exploits since 28th of June 2024.

CrowdSec has not observed any significant exploitation activity targeting CVE-2017-3066 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attack attempts typically leverage requests to URLs containing `/flex2gateway/amf`.

## Timeline

- 2017-04-27: CVE Published. CVE-2017-3066 is published to NVD.
- 2024-06-28: Rule Released. CrowdSec releases a rule to detect CVE-2017-3066 exploitation attempts against the CrowdSec Network.
- 2025-02-24: CISA KEV. CVE-2017-3066 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-02-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2017-3066 for the first time.
- 2025-03-17: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html
- https://www.exploit-db.com/exploits/43993/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2017-3066) follows observed exploitation activity for CVE-2017-3066. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.