ColdFusion is vulnerable to OS command injection, allowing an attacker to execute arbitrary code in the context of the current user. The vulnerability is triggered by an improper neutralization of special elements used in an OS command, and exploitation does not require any user interaction. Scope is changed, indicating that the impact can spread across multiple components or the entire application.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are affected. No specific affected versions are listed in the CNA data, so all releases in these product lines should be considered vulnerable until the vendor issues a fix.

The CVSS score of 10 indicates the maximum severity for this vulnerability. The EPSS score of 2% suggests a low to moderate probability that the flaw will be exploited in the near term. ColdFusion is not listed in the CISA KEV catalog, and no confirmed incidents of exploitation in the wild are reported. The flaw does not require user interaction and can be triggered by receiving malicious input to a ColdFusion component or service, which is then reflected directly into an operating‑system command. Because the scope is changed, the potential impact can extend beyond the initial target and affect a wider range of components or services.