Adobe ColdFusion Improper Access Control Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Adobe ColdFusion versions 2025.2, 2023.14, and 2021.20 and earlier. This vulnerability arises from improper access control, allowing a high-privileged attacker to disrupt application availability. The issue is confined to internal IP addresses and exploitation does not require user interaction.

Impact

Exploitation of this vulnerability can disrupt the availability of the application, leading to a denial-of-service condition.

Remediation

Users are advised to update to ColdFusion 2025 Update 3, ColdFusion 2023 Update 15, or ColdFusion 2021 Update 21. For more information on applying these updates, refer to the Adobe ColdFusion downloads page or the respective ColdFusion update tech notes.