The vulnerability is an Improper Input Validation flaw (CWE-20) that can lead to arbitrary code execution in the web application's current user context. No user interaction is required when an attacker supplies specially crafted input, and the flaw can change the scope of the compromised system. An attacker who exploits this could execute any commands with the privileges of the application user, compromising confidentiality, integrity, and availability.

Affected products are Adobe ColdFusion versions 2025.9, 2023.20 and any earlier releases. These systems remain vulnerable until patched or upgraded to a non‑affected version.

The CVSS score of 10.0 indicates maximum severity, and the EPSS score is currently not available, leaving uncertain the current exploitation probability. The issue is not listed in the CISA KEV catalog, but the lack of a KEV listing does not mitigate the high risk. Attackers can likely exploit remotely through HTTP requests without user interaction, potentially gaining full control of the application server.