ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. The vulnerability allows an attacker with high privileges to execute arbitrary code, and exploitation does not require user interaction. The issue is identified as a scope‑changing flaw (CWE‑863).

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are impacted. The vulnerable component defaults to an administrative network zone, but no explicit patch‑level versions are listed; the vulnerability applies to the product lines as distributed.

The CVSS score of 8.4 indicates a high‑severity flaw, while the EPSS score is less than 1 %, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the flaw allows arbitrary code execution when an attacker has high privileges and the component is restricted only to an administrative network zone, the likely attack vector is a local network or compromised user with elevated privileges. The scope change implies that exploitation could affect the entire system rather than a single user session.