The vulnerability involves improper input validation that allows an attacker to execute arbitrary code within the context of the current user on affected ColdFusion installations. This flaw is classified as CWE‑20 and can compromise confidentiality, integrity, and availability, since the attacker gains full execution rights without any user interaction. The description indicates a scope change, meaning the exploit can affect both the application and the underlying operating system if the application runs with elevated privileges.

Adobe ColdFusion versions 2023.19, 2025.8 and all earlier releases are affected. The vulnerability applies to the core ColdFusion engine regardless of deployment size or architecture. Administrators should verify that their Adobe ColdFusion installations match these versions before applying remediation.

The CVSS base score of 8.4 categorizes this as high severity, and the EPSS score is not available but the lack of user interaction requirement suggests that remote exploitation is possible. The vulnerability is not listed in the CISA KEV catalog, but its high impact necessitates immediate attention. Attackers could remotely send crafted input to the application, triggering code execution under the current user context and potentially escalating privileges if the application runs with elevated rights.