ColdFusion is affected by a code injection flaw that allows the execution of arbitrary code in the context of the current user. A low‑privileged attacker can exploit the vulnerability without any user interaction, and the description indicates that the scope is changed, implying the potential to affect the entire system.

The flaw impacts Adobe ColdFusion 2023 and Adobe ColdFusion 2025. Any instance of these products that has not applied the vendor’s security update is vulnerable.

The CVSS score of 9.9 indicates catastrophic impact, the EPSS score of less than 1% suggests a low but non‑zero exploitation probability at the time of this analysis, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation does not require user interaction and can be achieved from an attacker with network access to the ColdFusion service; the changed scope means that successful exploitation can lead to system‑wide compromise.