ColdFusion is affected by an incorrect authorization flaw (CWE-863) that enables a low‑privileged attacker to execute arbitrary code in the context of the running application. The vulnerability does not require user interaction and changes the protected scope, allowing an attacker to send crafted requests to a vulnerable instance and trigger code execution.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are vulnerable when the internal authorization logic fails to enforce proper access controls, permitting a low‑privileged actor to execute code on the host.

The CVSS score of 8.8 marks this flaw as high severity, while the EPSS score of less than 1 % indicates a low likelihood of immediate exploitation. The CVE is not listed in the CISA KEV catalog. The likely attack vector is remote, through HTTP requests to the ColdFusion web server; exploitation can result in arbitrary code execution with the privileges of the current user due to the scope change.