The vulnerability in Adobe ColdFusion allows an attacker to inject arbitrary code through a flaw in the service’s code generation logic. Because the application does not properly validate or sanitize user‑supplied data that is incorporated into executable code, an attacker can execute malicious instructions in the environment of the current server user, potentially compromising all application data and operations.

Affected by the vulnerability are Adobe ColdFusion 2023 and Adobe ColdFusion 2025. The advisory does not list specific sub‑versions, but all installations of these product lines are subject to the flaw until a patch is deployed.

The CVSS score of 9.1 signals a high severity flaw. The EPSS score of less than 1% indicates a low but nonzero chance of exploitation and the vulnerability is not yet in the CISA KEV catalog. Because exploitation does not require user interaction, it is inferred from the description that the attack could be carried out remotely. The risk to exposed ColdFusion servers is significant and the vulnerability should be mitigated with priority.