What is the CVSS score of CVE-2025-61809?

CVE-2025-61809 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.7%.

Which versions of Adobe ColdFusion are affected by CVE-2025-61809?

Adobe ColdFusion - the application server that many organizations rely on to host public-facing web applications - contains a critical security feature bypass in releases 2025.4, 2023.16, 2021.22 and…

How to fix or mitigate CVE-2025-61809?

Within 24 hours, take a full inventory of every ColdFusion deployment and identify any instance running 2025.4, 2023.16, 2021.22 or earlier, flagging which of those are reachable from the internet; for any externally exposed instance, immediately restrict access to the ColdFusion Administrator and internal-only interfaces (block administrative ports such as 8500 at the perimeter, allow-list source IPs, and place the service behind a reverse proxy or WAF with virtual patching rules for malformed input). Within 7 days, monitor Adobe advisory APSB25-105 continuously for a vendor-released hotfix, harden the service using the ColdFusion lockdown tool and secure configuration guidance, run the service account with least privilege, and enable and review audit logging for anomalous read or write activity on affected hosts. Within 30 days, apply the vendor patch as soon as it is released and validate it in a staging environment before production rollout, remediate or decommission any instances still on unsupported or end-of-life ColdFusion releases, and re-test external exposure to confirm that no administrative interface remains internet-facing; if remediation cannot be completed within that window, keep the compensating network and WAF controls in place and document the residual risk for security management.

Adobe ColdFusion CVE-2025-61809

CRITICAL

Improper Input Validation (CWE-20)

2025-12-10 psirt@adobe.com

Authentication Bypass Adobe Coldfusion

9.1

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Description states remote exploitation with no user interaction, unchanged scope, and unauthorized read+write access, giving PR:N/UI:N with C:H/I:H and A:N (no availability impact claimed).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 25, 2026 - 23:40 vuln.today

tag: Adobe added

Analysis Generated

Sep 25, 2026 - 23:36 vuln.today

CVE Published

Dec 10, 2025 - 00:16 cve.org

CRITICAL 9.1

DescriptionCVE.org

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction and scope is unchanged.

AnalysisAI

Security feature bypass in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier allows remote unauthenticated attackers to gain unauthorized read and write access without user interaction. This is a high-priority issue based on CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); the vulnerability stems from improper input validation, and there is no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis, with an EPSS score of 0.66% (50th percentile). Affected organizations should prioritize patching internet-reachable ColdFusion instances using Adobe advisory APSB25-105.

Technical ContextAI

The issue is an improper input validation weakness (CWE-20) in Adobe ColdFusion, a Java-based application server for web applications. CWE-20 covers failures to validate or sanitize externally supplied input before it is used in security-sensitive decisions; here Adobe describes the result as a security feature bypass that enables unauthorized read and write access. The CVSS vector confirms remote unauthenticated exploitation with no user interaction and unchanged scope, with high confidentiality and integrity impact but no availability impact. CPE data identifies Adobe ColdFusion 2021 at base and multiple update levels (update1 through update17 in the provided excerpt), and the affected range also includes 2025.4, 2023.16, and 2021.22 and earlier. The tags Authentication Bypass and Coldfusion reinforce that the flaw bypasses an access or security control rather than causing code execution; Adobe has not specified which security feature is bypassed, so deeper root-cause details are not available in the supplied intelligence.

RemediationAI

Patch available per vendor advisory: apply the fixed release identified in Adobe security bulletin APSB25-105 at https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html. No exact fixed version is supplied in the input, so confirm the applicable update path in the Adobe bulletin before upgrading and test in a non-production environment. If patching cannot be performed immediately, reduce exposure by placing ColdFusion behind a reverse proxy or firewall and restricting access to trusted networks; the trade-off is potential disruption for legitimate remote users, and this is not a substitute for the vendor fix. Adobe does not document a specific feature-level workaround for this improper input validation issue, so network isolation and monitoring should be treated as temporary compensating controls. Enable logging and monitor for unauthorized read/write activity, anomalous requests, and access to security-sensitive endpoints; this may increase alert volume but can help detect attempted bypass.