Adobe ColdFusion Improper Access Control Vulnerability Allowing Arbitrary Code Execution

A vulnerability has been identified in Adobe ColdFusion versions 2025.4, 2023.16, and 2021.22 and earlier. This vulnerability involves improper access control, which could lead to arbitrary code execution within the context of the current user. A high-privileged attacker could exploit this issue to bypass security measures and execute malicious code. Notably, exploitation does not require user interaction, and the vulnerability alters the scope of execution.

Impact

Exploitation of this vulnerability could result in arbitrary code execution, allowing an attacker to execute malicious code in the context of the current user.

Remediation

Users are advised to update to ColdFusion 2025 Update 5, ColdFusion 2023 Update 17, or ColdFusion 2021 Update 23. For more information on these updates, refer to the Adobe ColdFusion Security Bulletin APSB25-105.