CVE-2016-1114: Adobe ColdFusion

Critical severity, CVSS 9.8. EPSS: 8.8% chance of exploitation in the next 30 days.

Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Affected products

• Adobe ColdFusion: version 10.0 only; version 11.0 only; version 2016 only

Published 2016-05-11. Last modified 2026-06-17.