Adobe ColdFusion Improper Input Validation Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing arbitrary code execution has been identified in Adobe ColdFusion. This issue arises from improper input validation and affects ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier. The vulnerability can be exploited by a high-privileged attacker without requiring user interaction.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary code execution on the server where ColdFusion is running.

Remediation

Users are advised to update to ColdFusion 2025 Update 5, ColdFusion 2023 Update 17, or ColdFusion 2021 Update 23. For more information on these updates, refer to the Adobe ColdFusion downloads page. Additionally, consult the ColdFusion Lockdown Guides for security configuration recommendations.