Adobe ColdFusion is vulnerable to a Server‑Side Request Forgery identified as CWE‑918. The flaw allows an attacker to trick the server into making arbitrary requests to internal or external resources. Because no user interaction is required, the vulnerability can be activated remotely and the scope of the vulnerability is changed, potentially allowing the attacker to elevate privileges. The description explicitly notes that exploitation could result in privilege escalation.

The vulnerability affects Adobe ColdFusion products running the 2023 and 2025 release lines. No specific patch or version number is listed, so all installations of these major releases are potentially vulnerable until a patch is applied or an equivalent mitigated configuration is in place.

The CVSS score of 8.6 indicates a high severity. The EPSS score of less than 1% shows that the probability of exploitation is low but not zero, indicating that most attacks would likely be opportunistic and require advanced research or specialized attack campaigns. Because the attack does not require user interaction, an adversary with network access to the ColdFusion instance could exploit the SSRF directly. The vulnerability is not listed in the CISA KEV catalog, suggesting that there are no known, widespread, actively exploited instances at present, but the high impact warrants immediate attention.