This vulnerability arises from improper input validation that can allow an attacker to execute arbitrary code in the context of the user running ColdFusion. An attacker could inject malicious scripts into a web page or a file that, when opened by a victim, would allow the attacker to gain elevated access or control over the victim's account or session. The weakness is identified as CWE‑20 and the vulnerability scope is changed, meaning that code execution can potentially affect higher privilege contexts.

Adobe ColdFusion versions 2025.9, 2023.20 and all earlier releases are affected.

The CVSS score of 9.3 indicates a critical severity. The EPSS score is currently not available, but the lack of a publicly known exploit suggests that attack likelihood remains low until a proof‑of‑concept emerges. However, exploitation requires a user to open a malicious file, meaning it is a user‑interaction attack. Because the vulnerability can change the overall scope, an attacker who succeeds can gain system‑wide privileges if proper safeguards are not applied. The vulnerability is not listed in the CISA KEV catalog, so there is currently no evidence of widespread exploitation.