ColdFusion is vulnerable to improper input validation that allows a low‑privileged attacker to execute arbitrary code in the context of the current user. The flaw can be triggered without user interaction, meaning a remote attacker can send crafted requests directly to the server to exploit the vulnerability.

The vulnerability affects Adobe ColdFusion 2023 and Adobe ColdFusion 2025. Specific version numbers are not provided, so all installed instances are potentially susceptible until patched.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. The EPSS score of less than 1% indicates that exploitation is unlikely but not impossible. Based on the description that user interaction is not required, it is inferred that the vulnerability can be triggered remotely from both external and internal networks, leading to arbitrary code execution. The vulnerability is not listed in the CISA KEV catalog.