The CVE describes an Incorrect Authorization flaw in Adobe ColdFusion 2023 and 2025 that allows a low‑privileged attacker to run arbitrary code in the context of the authenticated user. Based on the description, it is inferred that the fault is triggered by crafted input to an authenticated endpoint and does not require any user interaction. Because the privilege boundaries are bypassed, the attacker can potentially compromise the entire system.

Affected systems include Adobe ColdFusion 2023 and 2025. No specific sub‑versions are listed, so administrators should verify that their deployments are not a vulnerable release of either year. Based on the description, it is inferred that the problem arises in the authorization logic for certain ColdFusion modules and is present where those modules are enabled.

The CVSS score of 8.8 marks the flaw as high severity, while the EPSS score of less than 1 % indicates a low current exploitation probability. The issue is not in CISA’s KEV catalog, implying that no widespread public exploits are known. Based on the description, it is inferred that the attack vector is likely an authenticated web request to the affected component; once exploited, an attacker can execute arbitrary code with the privileges of the authenticated session.