Adobe ColdFusion Improper Access Control Vulnerability Allowing Unauthorized Write Access and Potential Denial-of-Service

A vulnerability has been identified in Adobe ColdFusion versions 2025.4, 2023.16, and 2021.22 and earlier. This vulnerability involves improper access control, allowing a low-privileged attacker to bypass security measures and gain limited unauthorized write access, which could potentially lead to a denial-of-service condition. Exploitation of this vulnerability requires user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized write access, potentially leading to a denial-of-service condition.

Remediation

Users are advised to update to ColdFusion 2025 Update 5, ColdFusion 2023 Update 17, or ColdFusion 2021 Update 23. For more information on these updates, refer to the Adobe ColdFusion Security Bulletin APSB25-105.