Adobe ColdFusion CVE-2025-64897
MEDIUMSeverity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H
Local authenticated low-priv user with required interaction (AV:L/PR:L/UI:R); no data disclosure (C:N), limited write (I:L), DoS is the main impact (A:H).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
3DescriptionCVE.org
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access potentially resulting in denial of service. Exploitation of this issue requires user interaction.
AnalysisAI
Improper access control in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier allows a local, low-privileged authenticated user - if they can persuade a legitimate user to interact with a crafted element - to bypass security checks and perform limited unauthorized writes, potentially causing denial of service. With CVSS 5.6, EPSS 0.13% (2nd percentile), no CISA KEV listing, and no public exploit identified at time of analysis, this is a genuinely low-priority issue whose realistic exploitation is constrained by the need for local access, existing credentials, and user interaction.
Technical ContextAI
The flaw is an instance of CWE-284 (Improper Access Control), meaning a missing or incorrect authorization check in Adobe ColdFusion lets a user who already holds low-level local access turn permitted operations into unauthorized write actions. ColdFusion is a Java-based application server used for rapid web application development; the affected release lines are the 2021, 2023, and 2025 generations, with Adobe's advisory naming 2021.22, 2023.16, and 2025.4 as the last affected updates. The supplied CPE data enumerates cpe:2.3:a:adobe:coldfusion:2021 (base) plus updates 1 through 17, covering only the 2021 line; the description explicitly includes the 2023 and 2025 lines, so the CPE list is narrower than the true affected scope and the advisory should be treated as authoritative. The CVSS vector AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H shows the attacker must be local, possess low privileges, and induce user interaction; the flaw yields no confidentiality impact, only limited integrity loss and a high availability impact via denial of service. EPSS is 0.13% at the 2nd percentile, giving no signal of observed exploitation.
RemediationAI
Apply the fixed release specified in Adobe's security bulletin APSB25-105 (https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html) for the applicable ColdFusion line (2021.x, 2023.x, 2025.x); the provided data does not name an exact patched version, so the bulletin is the authoritative source. Because exploitation requires local access, low privileges, and user interaction, interim compensating controls can be modest: restrict interactive logon to ColdFusion servers to a small set of trusted administrators (trade-off: may slow support and administration), run the ColdFusion process under an OS account with minimal write permissions outside required directories (trade-off: can break custom integrations that rely on broader write access), monitor and alert on unexpected file writes in the ColdFusion web root and configuration paths (trade-off: creates alert noise that must be tuned), and remind users to avoid interacting with untrusted content on or relating to ColdFusion hosts. Given CVSS 5.6, EPSS 0.13%, no KEV listing, and no public exploit identified at time of analysis, this can be scheduled in routine patch cycles rather than treated as an emergency.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-284 – Improper Access Control
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today