ColdFusion is compromised by an incorrect authorization flaw that can allow a low‑privileged attacker to execute arbitrary code in the context of the current user. The vulnerability does not require any user interaction and it raises the privilege scope of the attacker, potentially enabling further exploitation within the system.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are impacted. The advisory does not list the specific version ranges, so all releases of these product lines should be examined for the presence of the flaw.

The CVSS score of 8.8 classifies this flaw as high severity and the EPSS score of less than 1% suggests a very low yet non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that a remote attacker could trigger the flaw by sending crafted web requests to the ColdFusion application, exploiting the missing authorization checks to ascend privileges.