Adobe ColdFusion XXE Vulnerability Leading to Security Feature Bypass

A vulnerability allowing improper restriction of XML external entity references (XXE) has been identified in Adobe ColdFusion versions 2025.2, 2023.14, and 2021.20 and earlier. This vulnerability could enable a high-privileged attacker to bypass security measures or access sensitive information, without requiring user interaction.

Impact

Exploitation of this vulnerability could result in a security feature bypass, allowing attackers to circumvent certain protections or controls within the application.

Remediation

Users are advised to update to ColdFusion 2025 Update 3, ColdFusion 2023 Update 15, or ColdFusion 2021 Update 21. For instructions on how to update, refer to the Adobe ColdFusion downloads page or the respective ColdFusion update tech notes. Additionally, review the ColdFusion Lockdown Guides for security configuration recommendations.