ColdFusion suffers from an Incorrect Authorization weakness (CWE-863) that enables a low‑privileged attacker to execute arbitrary code in the context of the current user. The flaw requires a victim to open a malicious file, and the exploit path requires user interaction. Scope is changed, which expands the potential impact beyond the original boundaries.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are affected. Specific version numbers are not listed in the advisory; any installation of these releases should be considered at risk until a patch is applied.

The vulnerability carries a CVSS score of 8.2, indicating high severity, while the EPSS score is below 1%, suggesting a very low exploitation probability. The issue is not in CISA KEV catalog. The exploit path requires the victim to open a malicious file; once satisfied, the attacker can run arbitrary code under the privileges of the running ColdFusion instance. Because scope is changed, successful exploitation could affect the entire application or server.