ColdFusion is vulnerable to Server‑Side Request Forgery (SSRF), a flaw identified as CWE‑918, that can enable an attacker to send arbitrary requests from the server. The vulnerability can lead to privilege escalation without requiring user interaction. The scope change indicates that exploitation may affect higher privilege levels than originally intended.

The affected products are Adobe ColdFusion 2023 and Adobe ColdFusion 2025. No specific version numbers are given, so all releases within these major versions are potentially impacted.

The score of 10 on the CVSS metric indicates a critical severity, while the EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so it may not be widely exploited yet, but its combination of remote SSRF and privilege escalation makes it a high‑risk concern. The likely attack vector is that an attacker can craft a request that ColdFusion will forward on behalf of the host, potentially accessing internal services or resources, and given the scope change, may gain higher privileges on the system.