The vulnerability is an incorrect authorization flaw in Adobe ColdFusion that allows a low-privileged attacker to execute arbitrary code in the context of the current user. Exploit does not require user interaction and the scope of the vulnerability is altered, meaning that privilege boundaries can be bypassed. This flaw could let an attacker run code with the privileges of the compromised user, potentially gaining further access or elevating privileges if additional weaknesses exist.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025. No specific subversion information is provided; the issue applies across the stated product lines.

The CVSS score of 7.8 indicates high severity. The EPSS score of less than 1% suggests that the current likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw involves arbitrary code execution and does not require user interaction, it remains a serious risk for systems exposed to untrusted input or that have exposed administrative interfaces. Exploitation requires conditions beyond the attacker’s control, so the exact attack path is not fully understood; the most likely vector is exploitation of internal or remote requests to ColdFusion services, but this is inferred rather than explicitly stated by the vendor.