The vulnerability is an Improper Input Validation flaw in Adobe ColdFusion that can lead to arbitrary code execution in the context of the current user. An attacker with elevated privileges could cause a victim to run malicious code simply by opening a specially crafted file, resulting in loss of confidentiality, integrity, and availability for that account.

Adobe ColdFusion versions 2023.18, 2025.6, and all earlier releases are affected. The vulnerability exists across these releases and can be exercised via the ColdFusion File or object handling mechanisms.

The flaw carries a CVSS score of 8.4, indicating a high severity risk. Because the exploit requires privileged account access and user interaction, the realistic attack surface is limited, and the issue is not listed in CISA’s KEV catalog. The primary attack vector is a malicious file that a victim must open, so the risk is highest when the ColdFusion environment is exposed to untrusted users or files.