The vulnerability in Adobe ColdFusion stems from an incorrect authorization check that allows an attacker with low privileges to execute arbitrary code in the context of the current user. Because the check is bypassed, the attack can trigger code execution without any user interaction. The flaw is classified as CWE‑863 and results in a change of the affected component’s scope, allowing the compromise to spread beyond the initially targeted module.

Adobe’s ColdFusion products are affected, specifically the 2023 and 2025 release lines. No specific patch versions are listed, so all instances of these releases are considered vulnerable until an official update is applied.

The CVSS score of 8.8 indicates a high severity, and the EPSS score of <1% suggests that exploitation is unlikely at present but could occur if attackers target known unmet patches. The vulnerability is not listed in the CISA KEV catalog. Exploitation does not require user interaction and can be performed by a low-privileged attacker once they can reach the vulnerable end‑points; the scope change may allow the attacker to move laterally within the affected system.