A critical remote code execution flaw exists in the endpoint /index.cfm/_api/json/v1/default of Mura CMS versions prior to 10.0.712. The vulnerability arises because the "method" parameter in POST requests is not validated or sanitized before it is processed by the ColdFusion engine. This allows an attacker to inject and execute arbitrary CFML expressions or instantiate malicious Java objects, giving the attacker the ability to run arbitrary code with the privileges of the web application.

The flaw affects Mura Software’s CMS, specifically installations running a version older than 10.0.712. No vendor product version beyond that is known to be impacted.

The CVSS score of 9.3 indicates a critical severity, and the EPSS score of < 1% indicates a very low but non-zero probability of exploitation; the lack of a KEV listing suggests that exploitation is not yet widespread. The likely attack vector is a remote attacker sending a crafted POST request to the vulnerable endpoint, exploiting the unvalidated "method" parameter to execute arbitrary code. Because the vulnerability allows direct execution of CFML and Java objects, the impact can be complete compromise of the target system.