Adobe ColdFusion CVE-2025-61822

Apply the vendor fix from Adobe Security Bulletin APSB25-105 (https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html); the bulletin is the authoritative source for the exact patched build numbers for the 2021, 2023 and 2025 tracks, so upgrade to the highest update available in your track and retire end-of-life 2021 deployments where feasible. Until patching is complete, treat the high-privilege requirement as a compensating control and harden it: audit and minimize who holds ColdFusion Administrator, RDS and administrative roles, since PR:H means only already-privileged accounts can trigger the write, and rotate credentials for those accounts. Restrict network reach to the ColdFusion administrator and internal control surfaces (default admin port 8500 and the CFIDE/adminapi paths) with firewall rules or a reverse-proxy allowlist - the trade-off is that legitimate remote administration must move to a hardened jump host, and our assessed vector is network-reachable (AV:N) so this exposure reduction matters even though Adobe's original vector used an adjacent network position (AV:A). Tighten filesystem permissions so the ColdFusion service account can write only to its designated webroot and temp directories rather than the whole disk; this can break legitimate CFML applications that write outside those paths, so test in staging first. Disable unused services such as RDS if not required, enable Adobe's lockdown tool to reduce attack surface, and monitor the ColdFusion webroot and web-accessible directories for newly created or modified files (.jsp, .cfm, .cfc) as a detection control, since the end goal of an arbitrary write here is typically webshell deployment.