ColdFusion contains an incorrect authorization flaw that enables an attacker with low privileges to execute arbitrary code under the current user’s context. The CVE description does not explicitly state confidentiality, integrity, or availability impacts; however, the ability to run arbitrary code is likely to compromise these assets, which is inferred from the nature of the vulnerability. Scope is changed, indicating that the flaw elevates the attacker’s capabilities beyond the originally intended boundaries.

Adobe ColdFusion versions 2023 and 2025 are affected.

The CVSS score of 8.8 signals a high severity. The EPSS score of less than 1% indicates a low but nonzero probability of exploitation. Based on the description, it is inferred that the vulnerability is not marked in the CISA KEV catalog, but the lack of user interaction required and the changed scope suggest it could be used remotely to execute code. The exploitation path involves leveraging the incorrect authorization check to trigger arbitrary code execution; no prerequisites beyond low‑privilege access to the application are required.