CVE-2019-7840

—

CVSS 3.0

9.8 critical

EPSS

17%p97

Published

Jun 12, 2019 (Jun 12, 2019)

Modified

Jun 17, 2026

Description

ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendors: adobe
Products: coldfusion
Weakness: CWE-502
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (17.2%)

In the news2 stories

Adobe Patch Tuesday updates fix code execution issues in Campaign, ColdFusion, and Flash

Security AffairsJun 11, 22:36 UTC · Jun 11, 2019Vulnerability CVE-2019-7838 CVE-2019-7839 CVE-2019-7840+2 CVEs

Adobe Issues Critical Patches for ColdFusion, Flash Player, Campaign

The Hacker NewsJun 11, 18:45 UTC · Jun 11, 2019Vulnerability in the wildCVE-2019-7838 CVE-2019-7839 CVE-2019-7840+2 CVEs