Adobe ColdFusion 10 before Update 19 11 before Update 8 and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections library.