The vulnerability in Adobe ColdFusion results from improper input validation, allowing a low‑privileged attacker to bypass built‑in security mechanisms. Because the flaw does not require user interaction, a malicious actor can supply crafted data that the application accepts, enabling unauthorized read and write operations.

Adobe ColdFusion versions 2023.19, 2025.8 and all earlier releases are affected. Any ColdFusion instance running these or earlier versions is at risk, particularly if it exposes services without sufficient access controls.

The CVSS score of 8.1 indicates a high potential impact. The vulnerability can be triggered remotely without user interaction and permits bypass of security controls, presenting a tangible risk. Although the EPSS score is not available and the issue is not in CISA’s KEV catalog, the possibility of unauthorized data access makes this a significant threat based on severity and bypass capability.