What is the CVSS score of CVE-2025-61811?

CVE-2025-61811 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.2%.

Which versions of Adobe ColdFusion are affected by CVE-2025-61811?

Adobe ColdFusion 2025.4, 2023.16, 2021.22, and earlier are affected by a critical arbitrary code execution flaw that requires an attacker to already hold high privileges on the instance.

How to fix or mitigate CVE-2025-61811?

Within 24 hours, inventory all Adobe ColdFusion instances to identify any running 2025.4, 2023.16, 2021.22, or earlier; restrict network access to ColdFusion Administrator, CFIDE, and other administrative endpoints to trusted management networks only; enforce multi-factor authentication and review all high-privilege ColdFusion accounts for necessity. Within 7 days, reduce the attack surface by disabling unused administrative features, applying least privilege to ColdFusion service accounts, enabling detailed logging and alerting for path traversal and improper access attempts, and deploying WAF or network segmentation rules to block unauthorized access to administrative paths. Within 30 days, continue monitoring vendor advisories for a fixed version, test and deploy the vendor patch as soon as it is released, and conduct a forensic review of privileged account activity and administrative access logs to detect any prior exploitation attempts; if a patch remains unavailable, maintain compensating controls and consider migrating to a supported, isolated deployment.

Adobe ColdFusion CVE-2025-61811

CRITICAL

Path Traversal (CWE-22)

2025-12-10 psirt@adobe.com

RCE Path Traversal Adobe Coldfusion

9.1

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Network-reachable, low-complexity, but requires high privileges per 'high privileged attacker' (PR:H); scope change and full code execution justify S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 25, 2026 - 23:40 vuln.today

tag: Adobe added

Analysis Generated

Sep 25, 2026 - 23:36 vuln.today

CVE Published

Dec 10, 2025 - 00:16 cve.org

CRITICAL 9.1

DescriptionCVE.org

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could leverage this vulnerability to bypass security measures and execute malicious code. Exploitation of this issue does not require user interaction and scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion 2025.4, 2023.16, 2021.22, and earlier requires an attacker who already holds high privileges on the instance, who can exploit a path traversal and improper access control flaw to bypass security measures and run code in the context of the current user. The issue is network-accessible, low-complexity, and needs no user interaction, with a CVSS 3.1 base score of 9.1; however, PR:H is the key limiter because administrative or equivalent access must be obtained first. No public exploit identified at time of analysis, and EPSS is 1.20% (67th percentile).

Technical ContextAI

Adobe ColdFusion is a Java-based application server used for web application development and deployment. The flaw is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), which points to path traversal as the root-cause class: an attacker who already has high privileges can manipulate file paths or access controls to reach resources outside the intended directory, and the accompanying improper access control allows security bypasses. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H shows a network-reachable, low-complexity issue that requires high privileges and no user interaction, with changed scope and full confidentiality, integrity, and availability impact; changed scope means the vulnerable component can affect resources beyond its normal security boundary. The supplied CPE data enumerates Adobe ColdFusion 2021 base and update1 through update17, while the description and advisory cover 2025.4, 2023.16, 2021.22, and earlier releases. The tags (RCE, Path Traversal, ColdFusion) align with code execution achieved through path traversal and access-control abuse rather than a memory-safety bug.

RemediationAI

Apply the fixed ColdFusion release specified in Adobe advisory APSB25-105 for the affected branch (2025, 2023, or 2021); the supplied data points to that advisory but does not include an exact patched version, so validate the hotfix or update level against Adobe guidance before upgrading. Patch available per vendor advisory. Because exploitation requires high privileges, prioritize reducing the population that can reach that prerequisite: restrict network access to ColdFusion administrative interfaces, RDS, and other management endpoints to trusted networks; enforce MFA and least privilege for ColdFusion administrators; audit and rotate credentials for privileged accounts; and remove unnecessary admin mappings. Implement file-system controls so the ColdFusion service account cannot write to or execute from web-accessible, temporary, or sensitive directories, and restrict any file-import, upload, or path-handling endpoints that could be abused for traversal; these controls may disrupt legitimate administrative workflows or file-processing features, so test them in a staging environment.