Is CVE-2023-38203 (Adobe ColdFusion Deserialization of Untrusted Data) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-38203 to its Known Exploited Vulnerabilities catalogue on 8 January 2024, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. Any organisation running the affected product should treat remediation as urgent.

What “exploited in the wild” means for this CVE

For a CVE like this, “being exploited in the wild” means the issue has moved beyond theoretical weakness or lab proof-of-concept and is being used in real attacks. That changes the response from routine patch planning to urgent exposure validation, prioritised remediation, and compromise assessment, because active exploitation often means scanning and follow-on intrusion are already underway.

When a vulnerability is in the CISA KEV catalogue, the operational question is no longer whether exploitation is possible, but whether your environment is still exposed. That is why defenders should treat KEV status as a high-confidence signal for immediate action, then use vendor guidance and asset inventory to confirm whether any ColdFusion instance is reachable, internet-facing, or embedded in a larger service stack.

Why deserialization flaws are especially dangerous

deserialization of untrusted data is a high-impact class of weakness because the application may accept attacker-controlled input and turn it into executable program state. In practice, that can create remote code execution, which means the attacker is no longer limited to reading data or breaking a single workflow. The same flaw can become the entry point for web shell placement, privilege escalation, and lateral movement if the host is weakly segmented.

ColdFusion deployments are especially sensitive when they sit near business applications, internal APIs, or administrative interfaces. A deserialization flaw can be attractive to attackers because it offers a direct path from web request to server-side execution, which is often more valuable than credential theft alone. If the server also stores secrets, service credentials, or database connections, the blast radius can quickly expand beyond the initial application.

What to do when patching cannot happen immediately

If remediation is delayed, the priority is to reduce exposure rather than rely on the hope that exploitation will not target you. That usually means isolating the system, restricting access to trusted sources, reviewing internet exposure, and checking whether compensating controls such as WAF rules, network ACLs, or temporary service shutdowns can reduce the attack surface while the vendor fix is prepared and tested.

Because active exploitation can precede public detection, teams should also look for signs of prior compromise on the ColdFusion host and adjacent systems. Review web logs, process creation, unusual child processes, new files in web directories, unexpected outbound connections, and any indicators that the application server executed commands outside its normal workload. If the host was reachable from the internet, assume the possibility of attempted exploitation even if no obvious alert fired.

Use the Zero-Day and Exploited Vulnerabilities Guide to structure triage around KEV status, emergency mitigation, and post-patch hunting, and use the Insecure Deserialisation Guide to validate whether your code paths, filters, or object handling patterns are actually safe.

How to confirm exposure and decide whether to rotate anything else

Confirm exposure first by identifying every ColdFusion deployment, the versions in use, and which instances are reachable from untrusted networks or exposed through a reverse proxy. Then map each instance to the business service it supports, because the remediation decision is not just about the server, it is about the applications, integrations, and credentials that server could have accessed if exploitation occurred.

Rotation becomes material when the vulnerable system could have exposed secrets, session material, API keys, database credentials, or service account credentials. If you find evidence of exploitation, or if the system had privileged access to back-end resources, rotate the secrets that were reachable from that host and invalidate sessions or tokens that may have been minted on it. Use the Vulnerability Management Guide to tie that response to asset scope, prioritisation, and verification rather than treating the CVE as a one-off patch task.

Risk and Threat Considerations

Active exploitation materially raises the odds of rapid compromise because attackers can combine initial code execution with web-facing reach, weak segmentation, and stored secrets. The most important risk is not only service disruption, but silent post-exploitation activity such as credential harvesting, staging, and persistence on a system that defenders still assume is merely vulnerable.

Failure mechanism: An attacker sends crafted input to the deserialization path, gains code execution in the application context, and then uses that foothold to enumerate the host, access adjacent resources, or implant persistence before defenders complete remediation.

Impact: The result can include unauthorized execution, data access, service compromise, and wider environment exposure if the ColdFusion server can reach internal systems or holds reusable secrets.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	The question is about a KEV-listed exploited CVE and urgent remediation.
Recommendation — Prioritise and verify remediation of KEV-listed exposures using continuous vulnerability management.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	Active exploitation makes vulnerability prioritisation and remediation central to the response.
Recommendation — Escalate known-exploited vulnerabilities into prioritized remediation and verification workflows.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE requires urgent flaw remediation after confirmed exploitation signals.
Recommendation — Patch or mitigate the flaw promptly and verify the vulnerable component is no longer exposed.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	A public-facing ColdFusion exploit aligns with attacker exploitation of exposed applications.
Recommendation — Hunt for exploitation of internet-facing ColdFusion instances and correlate web logs with host activity.
OWASP ASVS	V15 — Secure Coding and Architecture	Deserialization of untrusted data is a secure-architecture weakness with code-execution impact.
Recommendation — Review deserialization boundaries and remove unsafe object handling from application design.

Practitioner Guidance

What to verify: Verify whether any ColdFusion instance is internet-facing, whether it has been exposed long enough to be probed, and whether the server can reach sensitive internal services. Exposure plus reachability is what turns an application flaw into an enterprise incident.

Decision rule: If the affected system is production and externally reachable, treat patching as urgent and hunt for compromise before you spend time on root-cause analysis. If patching must wait, reduce reachability first, then perform log and host review, then rotate only the secrets that were actually in the server’s trust boundary.

Practitioner takeaway: For exploited-in-the-wild deserialization flaws, the correct sequence is exposure check, remediation, and compromise assessment, not reassurance based on the absence of an alert.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org