The vulnerability is an Incorrect Authorization flaw in Adobe ColdFusion 2023 and 2025 that allows an attacker to read sensitive memory, potentially exposing confidential data without any user interaction. It is classified as CWE-863 and can lead to data disclosure, compromising confidentiality of information stored in application memory.

Affected systems include Adobe ColdFusion 2023 and Adobe ColdFusion 2025. Users should refer to the Adobe advisory linked for the latest security updates that mitigate this issue.

The CVSS score of 7.5 indicates a moderate to high severity, while the EPSS score being less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw without user interaction, potentially from a remote context, resulting in disclosure of sensitive memory.