U.S. CISA adds Adobe ColdFusion and Oracle Agile PLM flaws to its Known Exploited Vulnerabilities catalog

CVE-2017-3066 is a Java deserialization vulnerability (CWE-502) in the Apache BlazeDS library bundled with Adobe ColdFusion, which handles the product's Flex/AMF remoting functionality. An unauthenticated remote attacker can trigger it by sending crafted serialized Java objects to the server's BlazeDS message broker endpoints over the network. Successful exploitation allows arbitrary code execution with the privileges of the ColdFusion service, and the critical CVSS 3.1 score of 9.8 reflects that no privileges, user interaction, or special conditions are required. Users of Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier are affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-02-24 alongside an Oracle flaw, its EPSS probability of exploitation within 30 days is 90.6% (100th percentile), and a public proof-of-concept exploit is available on Exploit-DB (43993).

Do: Update all ColdFusion 10, 11, and 2016 servers beyond the affected update levels per Adobe's vendor guidance, or discontinue use of the product if mitigations are unavailable, as required by the CISA KEV listing. Until patched, restrict or block network access to the BlazeDS/AMF remoting endpoints (the /flex2gateway endpoints) at the firewall or web server layer, since these are the attack surface for this flaw, and review access logs for anomalous requests to them. A public proof-of-concept (Exploit-DB 43993) shows unauthenticated exploitation, so treat exposed instances as high-priority; ransomware use is currently listed as unknown.

CVE-2024-20953 is an insecure deserialization vulnerability (CWE-502) in the Export component of Oracle Agile Product Lifecycle Management (PLM), part of Oracle Supply Chain. A low-privileged authenticated attacker can trigger it over HTTP by sending crafted serialized data to the Export functionality; the flaw is easily exploitable and requires no user interaction. Successful exploitation lets the attacker take over the Agile PLM application, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.8). Only Agile PLM 9.3.6 is listed as affected, so organizations running that version — typically enterprises using Agile PLM to manage product lifecycle data — are in scope. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-02-24, confirming exploitation in the wild, though no public proof-of-concept is known and use in ransomware campaigns is unconfirmed (EPSS: ~3.9% probability of exploitation in 30 days).

Do: Apply the fix Oracle shipped for this CVE in its January 2025 Critical Patch Update for Agile PLM 9.3.6; if patching is delayed, restrict HTTP access to the Export component and apply vendor mitigations per CISA's KEV required action, or discontinue use of the product if mitigations are unavailable. Review HTTP logs and the Export component for signs of exploitation, and audit which low-privileged accounts can reach the application, since only limited credentials are needed to attack it.

CVE-2025-24989 is a critical (CVSS 9.8) improper access control flaw (CWE-284) in Microsoft Power Pages, Microsoft's low-code cloud service for building external-facing websites. An unauthenticated attacker can trigger it over the network by interacting with an affected Power Pages site, bypassing the user registration control and elevating privileges without any prior credentials or user interaction. Successful exploitation grants elevated access with high impact on the confidentiality, integrity, and availability of the affected site. Only organizations using Power Pages are in scope, and Microsoft has already mitigated the vulnerability in the cloud service and directly notified affected customers - if you were not notified, this vulnerability does not affect you. The flaw was actively exploited before and during patching, was added to CISA's Known Exploited Vulnerabilities catalog on 2025-02-21, and carries a 1.6% EPSS probability of exploitation in the next 30 days.

Do: No customer patch is required because Microsoft applied the fix service-side; review Microsoft's notification and follow its instructions to inspect your Power Pages sites for signs of exploitation (e.g., unexpected or unauthorized users, unusual privilege changes) and perform the recommended cleanup. Federal agencies must apply the vendor mitigations per CISA BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are unavailable. If you were not notified by Microsoft, the vulnerability does not affect you, though reviewing your site's registration settings is a prudent verification step.