U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe ColdFusion and Oracle Agile Product Lifecycle Management (PLM) vulnerabilities to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Adobe ColdFusion and Oracle Agile PLM vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
The two vulnerabilities are:
- CVE-2017-3066 Adobe ColdFusion Deserialization Vulnerability
- CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
CVE-2017-3066 (CVSS score of 9.8) is a Java deserialization vulnerability in the Apache BlazeDS library in Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier. An attacker can exploit the vulnerability to achieve arbitrary code execution.
CVE-2024-20953 (CVSS score of 8.8) is a Deserialization Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The flaw affects supported version 9.3.6. A low-privileged attacker with network access via HTTP to compromise Oracle Agile PLM could exploit this vulnerability to takeover Oracle Agile PLM.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by March 24, 2025.
Last week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Power Pages vulnerability, tracked as CVE-2025-24989, to its Known Exploited Vulnerabilities (KEV) catalog.
CVE-2025-24989 (CVSS score: 8.2) is an improper access control flaw in Power Pages, an unauthorized attacker could exploit the flaw to elevate privileges over a network potentially bypassing the user registration control.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
