ColdFusion is vulnerable to an improper input validation flaw that can cause the application to crash when it receives malformed data. The resulting crash brings the application down, creating a denial‑of‑service condition that prevents legitimate users from accessing the affected services. No user interaction is required, meaning remote actors can trigger the crash by sending specially crafted requests. The weakness is a classic input validation error (CWE‑20).

Adobe ColdFusion 2023 and ColdFusion 2025 are impacted. Version information is not specified, so all releases of these products are potentially vulnerable until a patch is applied.

The CVSS score of 7.5 indicates moderate severity focused on availability. The EPSS score of less than 1% suggests a very low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. However, because exploitation does not need user interaction and can be performed remotely, an attacker could disrupt services if the application is exposed to the network. The attack path likely involves sending a malicious payload to an exposed ColdFusion endpoint that does not properly validate input.