ColdFusion suffers an improper input validation flaw that permits an attacker with high privileges to execute arbitrary code in the context of the current user. The issue trigger arises when untrusted data is processed without adequate filtering, and it changes the vulnerability scope, meaning the compromise could extend beyond the originally targeted component. No user interaction is required to exploit the flaw.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are affected. The CVE does not list specific patch version numbers, so any installation of those releases must be considered vulnerable until protected by a patch or other mitigations.

The CVSS base score of 8.4 indicates high severity. EPSS below 1% reflects a low current exploitation probability, and the vulnerability is not yet listed in CISA's KEV catalog. Nevertheless, the vulnerable component is exposed only by default within an administrative network zone, so an attacker who gains privileged access or compromises an administrator account can exploit it from inside the network. Internal threat actors or credential compromise present the greatest risk, and because the scope is changed, a successful exploit could potentially elevate privileges or affect additional components.