The vulnerability is a server‑side request forgery that can allow a low‑privileged attacker to instruct ColdFusion to retrieve or send requests to internal resources. By exploiting this flaw, the attacker may gain privileges higher than the current user context, effectively escalating access within the application or to internal systems. The flaw does not require user interaction and the exploit changes the scope of the affected system.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are listed as affected. No specific patch versions are provided, so all current releases of these product lines should be considered vulnerable until an official patch is applied.

The CVSS score of 7.1 indicates a high risk, but the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not in the CISA KEV catalog. The description does not explicitly state the attack vector; it only notes that exploitation does not require user interaction. Based on the lack of user interaction requirement, it is inferred that a remote attacker could trigger the vulnerability through the web interface, but this inference is not confirmed. The scope change confirms that privilege escalation is possible, so patching remains the highest priority.