ColdFusion versions 2023.19, 2025.8 and all earlier releases contain an improper input validation flaw that allows attackers to execute arbitrary code in the context of the current user. Exploitation does not require user interaction, and an attacker with high privileges can run code potentially with elevated rights. The scope of the vulnerability has been changed to reflect this broader privilege escalation risk. The primary impact is remote code execution.

Adobe ColdFusion versions 2023.19, 2025.8 and all earlier releases are affected. The vulnerability applies to the core ColdFusion engine regardless of deployment size or architecture. Administrators should verify that their Adobe ColdFusion installations match these versions before applying remediation.

The CVSS base score of 8.4 categorizes this as high severity, and the EPSS score is < 1% but the lack of user interaction requirement suggests that remote exploitation is possible. The vulnerability is not listed in the CISA KEV catalog, but its high impact necessitates immediate attention. Attackers could remotely send crafted input to the application, triggering code execution under the current user context and potentially escalating privileges if the application runs with elevated rights.