ColdFusion is affected by an Improper Control of Generation of Code (CWE‑94) vulnerability that allows an attacker to inject and execute arbitrary code within the context of the currently authenticated user. Because the flaw does not require user interaction and the scope changes, the attacker can elevate privileges and compromise the confidentiality, integrity, and availability of the affected application.

Adobe ColdFusion releases 2023 and 2025 are affected. No specific patch versions are listed, so all installations of those major releases are presumed vulnerable until a vendor patch is applied.

The CVSS score of 10 indicates extreme severity, and the EPSS score of 1% suggests a low to moderate probability of exploitation in the wild. The vulnerability is not yet listed in CISA’s KEV catalog. Attackers could exploit this flaw through crafted requests that contain executable code fragments, with the assumption that code evaluation is enabled in the application. Because the flaw changes scope, the potential impact is higher if the attacker can gain wider privileges.