CVE-2025-61810

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope is changed.

• CWE-502

• https://helpx.adobe.com/security/products/coldfusion/apsb25-105.htmlVendor Advisory

Published

Dec 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-61805Substance3D - Stager versions 3.1.4 and earlier are affected…7.8
• CVE-2025-61806Substance3D - Stager versions 3.1.4 and earlier are affected…7.8
• CVE-2025-61807Substance3D - Stager versions 3.1.4 and earlier are affected…7.8
• CVE-2025-61808ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are…9.1
• CVE-2025-61809ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are…9.1
• CVE-2025-6181The StrongDM Windows service incorrectly handled input valid…8.5
• CVE-2025-61811ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are…9.1
• CVE-2025-61812ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are…8.4
• CVE-2025-61813ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are…7.4
• CVE-2025-61814InDesign Desktop versions 20.5, 19.5.5 and earlier are affec…7.8
• CVE-2025-61815InDesign Desktop versions 20.5, 19.5.5 and earlier are affec…7.8
• CVE-2025-61816InCopy versions 20.5, 19.5.5 and earlier are affected by a H…7.8