Adobe ColdFusion OS Command Injection Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing OS command injection has been identified in Adobe ColdFusion versions 2023.12, 2021.18, and 2025.0 and earlier. This vulnerability arises from improper neutralization of special elements used in OS commands, potentially leading to arbitrary code execution. A high-privileged attacker could exploit this issue to bypass security protections and execute malicious code. The exploitation requires user interaction, and the scope of the vulnerability is changed.

Impact

Exploitation of this vulnerability could result in arbitrary code execution on the server where ColdFusion is running.