CVE-2023-38203

Adobe ColdFusion suffered a critical deserialization vulnerability allowing remote code execution, linked to ransomware attacks.

The vulnerability in Adobe ColdFusion allowed attackers to execute arbitrary code through deserialization of untrusted data, directly enabling ransomware deployment. DIB organizations must ensure all ColdFusion instances are patched immediately, as this flaw was actively exploited in the wild and represents a severe compliance risk under CMMC/NIST 800-171 for unpatched critical vulnerabilities.

Shame score — A critical, actively exploited vulnerability linked to ransomware that Adobe failed to patch promptly, demonstrating severe negligence and avoidable exposure.