The vulnerability is an incorrect authorization flaw that allows a low‑privileged attacker to bypass security checks and gain write access to protected resources. Exploitation does not require user interaction and changes scope, enabling the attacker to modify application files, data, or configuration and compromise the entire ColdFusion deployment.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are impacted. No specific sub‑versions are listed; any installed instance of these product lines is considered vulnerable.

The CVSS score of 9.6 places this issue in the critical range, while the EPSS score of less than 1% indicates a low probability of widespread exploitation at present. Because the vulnerability enables a non‑interactive attacker to coerces the system into unauthorized write operations, the risk to confidentiality, integrity, and availability is high, especially if code or critical data can be altered. The flaw is not listed in the CISA KEV catalog, suggesting that publicly documented exploit kits or mass distributions are currently absent.