ColdFusion versions 2023.18, 2025.6 and earlier suffer from an improper input validation flaw that allows an attacker to bypass built‑in security controls. The vulnerability is listed as CWE-20 and can lead to unauthorized execution of privileged actions or access to protected resources. Exploitation of this issue requires the attacker to deliver malicious input that circumvents the expected validation logic.

Adobe describes the affected products as ColdFusion releases up to and including 2025.6, specifically 2023.18 and any earlier builds. Administrators should verify whether their deployment falls within these versions.

The CVSS score of 7.5 indicates a high severity consequence, though exploitation requires user interaction, which reduces the immediacy of risk compared to purely remote attacks. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation in the wild. The likely attack vector involves a crafted input sent to a publicly exposed ColdFusion application, prompting the victim to submit data that bypasses security checks.