ColdFusion suffers a Server‑Side Request Forgery flaw that allows an attacker with low privileges to instruct the server to make outbound requests to arbitrary hosts. The vulnerability can be abused to gain access to internal network resources, effectively elevating the attacker’s privileges. No user interaction is required and the CVSS impact indicates a high threat level. The change in scope means the vulnerability affects additional components beyond the originally intended target.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are known to be affected by this vulnerability. No specific sub‑version information is provided, so all published releases of these product lines should be considered vulnerable.

The CVSS score of 7.7 places the issue in the medium‑to‑high category, and the EPSS score of less than 1% suggests that exploitation is currently unlikely but still possible. The vulnerability is not listed inISA’s Known Exploited Vulnerabilities catalog, which mitigates immediate concern. However, because the flaw permits low‑privileged attackers to reach internal resources and change scope, the risk profile merits close attention. Successful exploitation requires that the ColdFusion instance be granted outbound network access, a condition that many production environments satisfy. Accordingly, the potential impact remains substantial if an attacker can coerce the server into querying internal services.