Adobe ColdFusion OS Command Injection Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing OS command injection has been identified in Adobe ColdFusion versions 2025.2, 2023.14, and 2021.20 and earlier. This vulnerability arises from improper neutralization of special elements, which could enable a high-privileged attacker to execute arbitrary code. Exploitation requires user interaction and affects components restricted to internal IP addresses.

Impact

Successful exploitation of this vulnerability could lead to arbitrary code execution on the server.

Remediation

Users are advised to update to ColdFusion 2025 Update 3, ColdFusion 2023 Update 15, or ColdFusion 2021 Update 21. For instructions on how to update, refer to the Adobe ColdFusion downloads page or the respective ColdFusion update tech notes. Additionally, review the ColdFusion Lockdown Guides for security configuration recommendations.