The vulnerability is a Server‑Side Request Forgery that allows an attacker with privileges to cause the ColdFusion server to request internal or external resources without restrictions. This change in scope can lead to privilege escalation by accessing internal network services or sensitive data.

Adobe ColdFusion 2023 and 2025 are affected. All builds of these releases are considered vulnerable unless patched; no specific version numbers are listed in the CNA data.

The CVSS score of 7.6 indicates high severity, and the EPSS score of less than 1% signals a low but non‑zero probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The SSRF can be triggered from the victim’s own server without user interaction, so the attack vector is internal or authenticated. Exploitation requires high privileges, but once achieved it can grant elevated access to internal resources.