The vulnerability is an incorrect authorization flaw that allows an attacker who can send crafted requests to an Adobe ColdFusion 2023 or 2025 instance to execute arbitrary code with the privileges of the application process.

The flaw impacts all active releases of ColdFusion 2023 and ColdFusion 2025 as listed by Adobe, with no specific patch level identified; any instance still running these major versions remains vulnerable unless a patch is applied.

Because the CVSS score of 9.9 indicates critical severity and the EPSS score remains below 1 %, exploitation is unlikely but possible; the lack of a need for user interaction and the change of scope mean that a remote attacker could elevate privileges and achieve full remote code execution, though the vulnerability is not listed in the CISA KEV catalog.