ColdFusion versions up to 2025.8 contain an Incorrect Authorization flaw (CWE-863) that allows an attacker with high privileges to execute code in the context of the current ColdFusion user without requiring any user interaction. Once leveraged, the flaw elevates the attacker’s access or control over the victim’s account or session. The vulnerability enables arbitrary code execution in a changed‑scope scenario.

Adobe ColdFusion versions 2023.19, 2025.8, and all earlier releases are affected. Any installation of these versions should be assessed for current patch status.

The CVSS score of 8.4 categorizes this vulnerability as high severity. EPSS is not available, so the exact exploitation probability is unknown; however, it is not listed in the CISA KEV catalog. Exploitation does not require user interaction, and a high‑privileged attacker who can access the ColdFusion environment can exploit the flaw to execute arbitrary code or elevate privileges. The likely attack vector is an internal or super‑user scenario, inferred from the description that the flaw is exploitable without user interaction.