ColdFusion suffers an incorrect authorization flaw that lets an attacker run arbitrary code with the account privileges of the web service’s current user. The weakness is a type‑of authorization failure (CWE‑863) and the flaw changes the attack scope, permitting escalation beyond the originally intended boundaries.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are affected. The flaw exists in the default administrative network zone of these versions.

Exploitation does not require user interaction; an attacker only needs access to the ColdFusion service within the protected administrative zone. Because the default configuration isolates this zone, it is inferred that the threat is primarily internal or from compromised hosts. The CVSS score of 9.6 signals critical severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog, so no publicly known exploits are recorded.