What is the CVSS score of CVE-2025-64898?

CVE-2025-64898 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe ColdFusion CVE-2025-64898

MEDIUM

Insufficiently Protected Credentials (CWE-522)

2025-12-10 psirt@adobe.com

Authentication Bypass Coldfusion

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network vector and no-auth confirmed by CVSS PR:N/AV:N; I:L reflects limited write only; C:N accepted per vendor scoping of impact to write access, not credential disclosure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 21:31 vuln.today

DescriptionNVD

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain unauthorized access by exploiting improperly stored or transmitted credentials. Exploitation of this issue does not require user interaction.

AnalysisAI

Insufficiently Protected Credentials in Adobe ColdFusion (versions 2025.4, 2023.16, and 2021.22 and earlier) enables unauthenticated remote attackers to gain limited unauthorized write access by exploiting improperly stored or transmitted credentials. The CVSS vector confirms network-accessible, zero-complexity exploitation with no privileges or user interaction required, producing limited integrity impact. Tagged as an Authentication Bypass vector, this vulnerability is distinct from a simple credential disclosure - it permits write operations, making it a meaningful integrity risk despite the moderate CVSS score. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-522 (Insufficiently Protected Credentials) describes a class of flaws where credentials are stored or transmitted without adequate protection - for example, cleartext storage, weak encoding, or exposure over unencrypted channels. In ColdFusion's context (cpe:2.3:a:adobe:coldfusion:2021 through update17, and by extension 2023.x and 2025.x lines), the affected code paths likely involve credential handling in the application server's administrative or runtime layers. The 'Authentication Bypass' tag indicates that improperly protected credentials can be recovered or leveraged by an attacker to skip normal authentication gates. Notably, the CVSS assigns C:N (no confidentiality impact), suggesting the primary exploitable outcome is not credential theft per se but the write access enabled by bypassing the authentication logic those credentials protect.

RemediationAI

Upgrade to a version of Adobe ColdFusion beyond the affected thresholds per Adobe advisory APSB25-105 (https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html): the advisory covers fixes across the 2021, 2023, and 2025 release lines, but exact patched update numbers are not independently confirmed from the available input data - consult the advisory directly for the specific fix versions. If immediate patching is not possible, restrict network access to the ColdFusion Administrator interface and any credential-handling endpoints using firewall rules or reverse-proxy IP allowlisting; this directly addresses the AV:N attack vector and reduces exposure without requiring application changes. Additionally, enforce TLS for all ColdFusion communication channels to mitigate credential interception scenarios inherent to CWE-522. Note that network restriction alone does not eliminate the vulnerability if the attacker already has internal network access.