Adobe ColdFusion
CVE-2025-61812
HIGH
Severity by source
AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
High-privileged admin needed (PR:H) and no user interaction (UI:N); I use AV:N since ColdFusion admin surfaces are typically network-reachable, differing from Adobe's AV:A, with full RCE impact and scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
3DescriptionCVE.org
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could allow a high privileged attacker to gain arbitrary code execution. Exploitation of this issue does not require user interaction.
AnalysisAI
Arbitrary code execution in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier is reachable by an attacker who already holds high privileges on the affected server, and requires no user interaction once that precondition is met. Adobe's advisory APSB25-105 documents the underlying improper input validation flaw, and the high-privilege prerequisite keeps this a privilege-to-code-execution escalation rather than an unauthenticated remote breach. There is no public exploit code identified at time of analysis, but the EPSS score of 4.71% (91st percentile) signals elevated predicted exploitation pressure relative to the broader CVE population.
Technical ContextAI
The root cause class is CWE-20, Improper Input Validation, in Adobe's JVM-based ColdFusion application server. ColdFusion exposes CFML templates, CFC (Component) endpoints, scheduled tasks, and an administrative console that all accept inputs which are then processed by server-side scripting and Java integration paths; where those inputs are not properly validated or constrained, an attacker with sufficient server-side privileges can shape data that ultimately reaches code-execution sinks. The CVSS vector assigns PR:H (high privileges required), AC:L (low complexity), UI:N (no user interaction), and S:C (scope change), meaning the exploit can affect resources beyond the vulnerable component's security authority - consistent with a privilege-to-code-execution escalation rather than a simple confidentiality leak. Notably, the vendor vector rates the attack vector as adjacent (AV:A) while our independent assessment rates it network (AV:N); either way, the practical gating factor is the high-privilege prerequisite, not the transport. CPE data enumerates the affected 2021 release channel across its update stream (base 2021 and update1 through update17 among the listed entries), confirming that interim ColdFusion updates are impacted and that patch-level tracking, not just major-version tracking, is required for asset inventory.
RemediationAI
Adobe addresses this flaw via advisory APSB25-105, which lists the fixed ColdFusion builds for the 2021, 2023, and 2025 release channels; because the exact fixed build numbers were not included in the intelligence provided here, administrators should consult the advisory directly at https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html and upgrade to the builds it specifies - Patch available per vendor advisory - rather than inferring version numbers. Until the upgrade is applied, the highest-value compensating control is minimizing the exposure of privileged ColdFusion surfaces: restrict network reachability to the ColdFusion Administrator console and administrative ports so that only trusted management hosts can reach them (trade-off: disrupts distributed or out-of-band administration and will break remote admin workflows that are not routed through a jump host or VPN), and remove or disable any unnecessary CFC endpoints, scheduled tasks, or service accounts with elevated rights on the server. Because exploitation requires high privileges, tightening who and what can act as an administrator on the ColdFusion instance - enforcing least privilege, auditing administrative accounts, and invalidating stale admin credentials - meaningfully reduces the attack surface, at the cost of some operational friction for teams accustomed to broad admin access. Logging and alerting on administrative logins followed by process creation, JVM-level code loading, or outbound connections from the ColdFusion host can provide detection coverage for the post-authentication code-execution step while the patched build is being scheduled and deployed.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote attacker upload a fi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today