The vulnerability in Adobe ColdFusion arises from improper input validation that allows an attacker to execute arbitrary code under the privileges of the current user. This flaw can lead to full compromise of the affected system, compromising confidentiality, integrity, and availability. The flaw is classified as CWE‑20 and is considered a high‑impact code execution weakness.

Adobe ColdFusion versions 2023 and 2025 are affected. Any installation of these releases without the security update from the Adobe APSB 26‑144 advisory is vulnerable.

The CVSS score of 9 indicates critical severity. The EPSS score is very low, at less than 1%, which indicates a low likelihood of exploitation, and the vulnerability is not listed catalog. The risk remains significant if an attacker obtains the necessary conditions, which are beyond the attacker’s control, but exploitation does not require user interaction. The attack vector is likely internal or remote network access to the ColdFusion application, with an attacker able to supply malformed input.