ColdFusion is vulnerable due to Incorrect Authorization, a weakness classified as CWE‑863, enabling any low‑privileged attacker to run arbitrary code with the privileges of the current user. The vulnerability can be exploited without user interaction and may change the security scope of the affected system. This can lead to full compromise of the application server.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are known to be affected. Version details beyond the product year are not available in the supplied data, so administrators should verify whether their installations match these product lines and assess whether they are running configurable components that could be exploited.

The CVSS score of 8.8 denotes a high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability does not require user interaction, suggesting that an attacker with low privileges inside the network can exploit the flaw. Because the issue changes scope, exploitation could allow an attacker to execute code with elevated privileges relative to the current user. The vulnerability is currently not listed in CISA’s KEV catalog, but the high CVSS heightens the urgency for remediation.