Coldfusion

Path traversal in Adobe ColdFusion 2023 (up to Update 21) and ColdFusion 2025 (up to Update 10) enables a low-privileged attacker on an adjacent network to read arbitrary files outside the intended application directory, with scope change indicating access can extend beyond the ColdFusion process boundary to OS-level files. The CVSS vector (AV:A/PR:L/S:C/C:H) reflects that while high confidentiality impact is possible, exploitation is gated by both network adjacency and authenticated access, meaningfully constraining the realistic attacker pool. No public exploit identified at time of analysis; EPSS at 0.27% (19th percentile) and SSVC exploitation status of 'none' further indicate low current exploitation pressure.

Server-side request forgery in Adobe ColdFusion lets a low-privileged, authenticated attacker coerce the server into issuing crafted outbound requests, bypassing a security control and gaining unauthorized read access to resources the attacker should not reach. The CVSS 3.1 scope-changed vector (S:C, C:H) indicates the impact extends beyond ColdFusion itself to backend or internal systems it can reach. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; remediation is available via Adobe security bulletin APSB26-82.

Insufficient session expiration in Adobe ColdFusion 2023 (through Update 21) and 2025 (through Update 10) allows a high-privileged authenticated attacker to reuse sessions that should have been invalidated, bypassing security controls to gain unauthorized write access. The CVSS score of 2.7 reflects the significant constraint of PR:H - the attacker must already hold high-level ColdFusion credentials. SSVC classification of exploitation:none and an EPSS of 0.35% (28th percentile) confirm no active exploitation or public exploit code at time of analysis.

Security feature bypass in Adobe ColdFusion allows a low-privileged, network-based attacker to defeat access controls and obtain unauthorized read access to data outside their intended authorization boundary. Adobe PSIRT classifies the root cause as improper input validation and tags it an authentication bypass; the CVSS 3.1 score is 7.7 with a changed scope, reflecting impact that crosses a security boundary. No public exploit has been identified at time of analysis, and no EPSS or CISA KEV data was provided.

Arbitrary code execution in Adobe ColdFusion allows an attacker with low-privileged access on an adjacent network to bypass authorization controls (CWE-863) and run code in the context of the current user, with a scope change that lets the impact extend beyond the vulnerable component. Adobe PSIRT reported the flaw and published advisory APSB26-82; it is tagged as RCE and authentication bypass with a CVSS 3.1 base score of 9.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the incorrect-authorization-to-RCE pattern in ColdFusion has historically drawn rapid attacker interest.

Missing authentication in Adobe ColdFusion allows an unauthenticated attacker on an adjacent network to trigger arbitrary code execution in the context of the current user, without any user interaction. The flaw (CWE-306) bypasses authentication on a critical function and carries a scope change, meaning the impact reaches beyond the vulnerable component. There is no public exploit identified at time of analysis, but the issue was reported by Adobe PSIRT and addressed in advisory APSB26-82.

SQL injection in Adobe ColdFusion 2023 and 2025 lets an attacker with high privileges inject crafted SQL that escalates to arbitrary code execution in the context of the current user, with a changed scope that extends impact beyond the vulnerable component. The flaw (CWE-89, CVSS 9.1) affects ColdFusion 2023 through Update 21 and ColdFusion 2025 through Update 10, requires no user interaction, and was disclosed by Adobe PSIRT. There is no public exploit identified at time of analysis, and EPSS is modest at 0.69% (49th percentile).

Code injection (CWE-94) in Adobe ColdFusion 2023 (Update 21 and earlier) and ColdFusion 2025 (Update 10 and earlier) allows a low-privileged, network-adjacent attacker to execute arbitrary code in the context of the current user without any user interaction. Because the CVSS scope is changed, successful exploitation can extend impact beyond the vulnerable component to the underlying host. There is no public exploit identified at time of analysis and the EPSS probability is low (0.43%, 35th percentile), but the near-maximum CVSS of 9.9 and Adobe's own PSIRT reporting make this a high-priority patch.

Privilege escalation in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) allows an adjacent-network attacker to bypass authorization checks and gain unauthorized read and write access without any user interaction. Because the CVSS scope is changed, a successful exploit can affect resources beyond the vulnerable component. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the CWE-863 root cause and 9.3 base score make it a high-priority patch for internet-adjacent ColdFusion servers.

Reflected Cross-Site Scripting in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) enables unauthenticated adjacent-network attackers to inject malicious scripts into a victim's browser session, achieving high-severity confidentiality and integrity impact through session hijacking or account takeover. Exploitation requires user interaction - a victim must open a malicious file - and CVSS scope change (S:C) reflects that the impact crosses from the ColdFusion server context into the victim's browser environment. EPSS sits at 3.75% raw probability but at the 89th percentile, indicating elevated relative risk among all CVEs; however, SSVC rates exploitation as 'none' and the vulnerability is not listed in CISA KEV, so no public exploit identified at time of analysis.

Arbitrary code execution in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) arises from a path traversal weakness that lets an authenticated attacker with high privileges escape a restricted directory and run code in the context of the current user. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, and CISA's SSVC rates the technical impact as total. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.93%), indicating no evidence of widespread automated exploitation yet.

Path traversal in Adobe ColdFusion allows an authenticated remote attacker (PR:L) to read arbitrary files outside the intended web/application scope by manipulating pathname input, per Adobe advisory APSB26-82. The flaw carries a critical 9.9 CVSS with a changed scope, meaning a successful read can reach files belonging to other security contexts on the host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.

Arbitrary code execution in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) allows an unauthenticated attacker on an adjacent network to run code in the context of the current user via improper input validation, with no user interaction required and a scope change extending impact beyond the vulnerable component. Adobe (APSB26-82) rates it CVSS 9.6; there is no public exploit identified at time of analysis and CISA's SSVC framework reports exploitation status 'none'. EPSS estimates a 2.17% 30-day exploitation probability (80th percentile), notable but not extreme for a critical-rated ColdFusion RCE.

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases arises from an Uncontrolled Search Path Element weakness that lets attacker-controlled files or libraries be loaded when a victim opens a malicious file, running code in the context of the current user. The bug carries a scope change (S:C), meaning execution can affect resources beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so real-world risk currently hinges on social-engineering a local user into opening a crafted file.

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and earlier arises from an uncontrolled search path element (library-hijacking-style) flaw that runs attacker code in the context of the current user when a victim opens a malicious file. The CVSS 3.1 base score is 8.2 with a changed scope, and exploitation is gated by user interaction and low-privilege local access. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets an unauthenticated network attacker run arbitrary code in the context of the current user via improper input validation (CWE-20), with no user interaction and a scope change to other components. Adobe rates this maximum severity (CVSS 10.0) and self-reported it; there is no public exploit identified at time of analysis and it is not yet listed in CISA KEV. Given ColdFusion's long history of mass-exploited RCE flaws, patching should be treated as urgent despite the current absence of a public PoC.

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and earlier stems from improper input validation (CWE-20) that lets an attacker craft a malicious file which, when opened by a victim, executes code in the context of the current user and can inject scripts to hijack the victim's account or session. The CVSS 3.1 base score is 9.3 (Critical) with a changed scope, reflecting cross-boundary impact once the victim is lured into interaction. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, so risk currently hinges on social-engineering a target into opening attacker-supplied content.

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and earlier lets a remote attacker run code in the context of the current user with no authentication and no user interaction. The flaw stems from improper input validation (CWE-20) and carries a maximum CVSS of 10.0 with a changed scope, meaning impact can extend beyond the vulnerable component. No public exploit identified at time of analysis, but ColdFusion's history of weaponized RCE bugs makes this a high-priority patch.

Remote code execution in Adobe ColdFusion (versions 2025.9, 2023.20 and earlier) lets a remote attacker run arbitrary code in the context of the current user with no authentication and no user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scored 10.0 with a changed scope. The root cause is improper input validation (CWE-20). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Server-Side Request Forgery in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote, unauthenticated attacker coerce the server into issuing crafted requests, bypassing intended security controls to gain unauthorized read access to otherwise protected resources. Because the CVSS scope is changed (S:C) and confidentiality impact is High, the attacker can reach internal systems or restricted endpoints beyond ColdFusion's own boundary without any user interaction. No public exploit identified at time of analysis, and this CVE is not on CISA KEV.

Path traversal in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets remote attackers (PR:N) read arbitrary files outside the intended web scope and perform limited writes, with no user interaction required. The scope-change (S:C) and high confidentiality impact drive a 9.3 critical rating, meaning a successful read can expose secrets - configuration, credentials, and source - that compromise components beyond ColdFusion itself. No public exploit is identified at time of analysis and the issue is not in CISA KEV, but ColdFusion's history of weaponized path-traversal and file-disclosure bugs makes prompt patching prudent.

Reflected Cross-Site Scripting in Adobe ColdFusion 2025.9, 2023.20 and earlier lets an attacker craft a malicious link that, when opened by a victim, injects and executes attacker-controlled script in the victim's browser session, with Adobe characterizing the impact as potential arbitrary code execution in the context of the current user. Because the CVSS scope is changed and confidentiality, integrity and availability impacts are all rated High, a successful attack against an authenticated ColdFusion administrator could compromise the management interface. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Path traversal in Adobe ColdFusion 2025.9 and 2023.20 (and earlier) allows unauthenticated remote attackers to bypass path restrictions and gain limited read and write access to files and directories outside the intended web root. The vulnerability is classified as a security feature bypass under CWE-22, exploitable over the network without user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low-complexity, zero-authentication attack surface makes it attractive for opportunistic actors targeting ColdFusion deployments.

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote attacker upload a file of a dangerous type (e.g., a CFML/JSP payload) and execute it in the context of the current user, with no user interaction required. The CVSS 3.1 base score is the maximum 10.0 with a changed scope, reflecting that successful exploitation breaches the ColdFusion process boundary. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but ColdFusion's history of weaponized file-upload/RCE bugs makes this a high-priority patch.

Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or access files outside intended directories and achieve arbitrary code execution in the context of the current user. Rated CVSS 10.0 with a changed scope and no user interaction required, this is among the most severe ColdFusion flaws possible. No public exploit identified at time of analysis, but the impact and trivial attack complexity make it a top patching priority.

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases stems from an unrestricted dangerous-file-type upload (CWE-434) that lets a remote attacker drop and execute a malicious payload, such as a CFM/CFML webshell, in the context of the running ColdFusion user. Rated CVSS 10.0 with a changed scope, it requires no user interaction and, per the provided vector, no authentication. No public exploit identified at time of analysis, though ColdFusion's history of weaponized upload bugs makes this a high-priority patch.

Arbitrary file read in Adobe ColdFusion 2023.19, 2025.8 and earlier allows remote unauthenticated attackers to exfiltrate sensitive files from the host filesystem via a malicious XML document that a victim opens through the application. The scope-changed CVSS 7.4 reflects that exploitation can impact resources beyond ColdFusion's own security context, though success hinges on user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Stored XSS in Adobe ColdFusion (2023.x through 2023.19 and 2025.x through 2025.8) enables a low-privileged attacker on an adjacent network to inject persistent malicious JavaScript into vulnerable form fields. When a victim user browses to the page containing the stored payload, the script executes in their browser context, with scope change indicating impact can extend beyond the immediate ColdFusion application - such as session hijacking or unauthorized browser-side actions. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in source intelligence.

Path traversal in Adobe ColdFusion 2023 (through update 17) and 2025.8 and earlier enables a security feature bypass that exposes files and directories outside intended access boundaries, with a scope change indicating impact extends beyond the ColdFusion process itself. The CVSS vector (AV:A/S:C/C:H/I:H/A:H) signals that a successful exploit can yield full confidentiality, integrity, and availability compromise of affected systems. No public exploit code has been identified and EPSS sits at 0.02% (7th percentile), but the SSVC technical impact rating of 'total' and Adobe PSIRT's own advisory (APSB26-64) confirm the theoretical severity is real.

Arbitrary code execution in Adobe ColdFusion 2023.19, 2025.8, and earlier stems from improper input validation (CWE-20), allowing a high-privileged attacker on an adjacent network to execute code in the context of the current user with a scope change that can impact resources outside the vulnerable component. No user interaction is required, but exploitation is constrained by the adjacent-network attack vector and high-privilege prerequisite, placing real-world risk well below what the 8.4 CVSS score might initially suggest. No public exploit code or active exploitation has been identified at time of analysis, consistent with an EPSS of 0.04% (14th percentile) and SSVC exploitation status of 'none'.

Security feature bypass in Adobe ColdFusion 2023.19, 2025.8 and earlier allows a low-privileged remote attacker to circumvent authentication controls and gain unauthorized read and write access to protected resources. The flaw stems from improper input validation (CWE-20) and is network-exploitable without user interaction, earning a CVSS 8.1 rating. No public exploit identified at time of analysis, but ColdFusion has a strong history of post-disclosure exploitation, making rapid patching essential.

Incorrect Authorization in Adobe ColdFusion 2023.x and 2025.x enables a high-privileged attacker on an adjacent network to execute arbitrary code in the context of the current user, with a scope change that extends impact beyond the application boundary. Reported by Adobe PSIRT and covered under advisory APSB26-64, this vulnerability carries a CVSS score of 8.4 despite requiring adjacent-network positioning and pre-existing high privileges - signals that meaningfully constrain realistic exploitation. No public exploit code has been identified and EPSS sits at 0.02% (6th percentile), consistent with SSVC's 'Exploitation: none' classification at time of analysis.

Arbitrary code execution in Adobe ColdFusion (2023.19, 2025.8 and all earlier updates) lets an unauthenticated attacker on an adjacent network run code in the context of the current ColdFusion process user without any user interaction. The flaw stems from improper input validation (CWE-20) and carries a scope change, meaning impact extends beyond the vulnerable component. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile), but the CVSS base score of 9.6 reflects total technical impact if reached.

Path traversal in Adobe ColdFusion 2023.18, 2025.6 and earlier allows authenticated remote attackers to bypass security controls and cause high availability impact through unauthorized file system access. CVSS 7.7 (High) reflects network-accessible attack vector with low complexity requiring only low-privilege authentication and scope change indicating impact beyond vulnerable component. No active exploitation (CISA KEV) or public POC identified at time of analysis, but zero-interaction exploitation pathway and vendor security advisory publication (APSB26-38) indicate concrete threat requiring prompt remediation.

ColdFusion versions 2023.18, 2025.6, and earlier are vulnerable to uncontrolled resource consumption that allows high-privileged attackers to trigger application denial-of-service by exhausting system resources without user interaction. This is a low-severity issue (CVSS 2.4) affecting only authenticated administrators, with no public exploit code or active exploitation reported.

ColdFusion versions 2023.18, 2025.6 and earlier are vulnerable to uncontrolled resource consumption that allows high-privileged attackers to trigger denial-of-service by exhausting system resources without user interaction. The CVSS score of 2.4 reflects low severity due to the high-privilege requirement (PR:H), though the attack vector is adjacent network access and does not require authentication once the attacker has elevated privileges.

Arbitrary code execution in Adobe ColdFusion 2023.18, 2025.6 and earlier allows authenticated attackers with high privileges to execute malicious code through improper input validation. Exploitation requires user interaction (victim opening a malicious file). EPSS data not available; no confirmed active exploitation (not in CISA KEV). CVSS 8.4 reflects high impact across confidentiality, integrity, and availability with scope change, though real-world risk is constrained by requiring both elevated privileges and user interaction.

Path traversal in Adobe ColdFusion 2023.18, 2025.6 and earlier enables unauthenticated remote attackers to read arbitrary files from the server file system without user interaction. The vulnerability carries a CVSS score of 8.6 (High) due to network accessibility, low complexity, and scope change, allowing access to sensitive files and directories beyond intended boundaries. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the lack of authentication requirements and low attack complexity suggest elevated risk for publicly accessible ColdFusion instances.

Remote code execution in Adobe ColdFusion 2023.18, 2025.6 and earlier allows unauthenticated adjacent network attackers to execute arbitrary code via improper input validation. The vulnerability requires no user interaction and achieves scope change, enabling attackers to break out of security boundaries. CVSS 9.3 (Critical). No confirmed active exploitation or public POC identified at time of analysis, but the combination of zero authentication requirements and code execution impact makes this a high-priority patching target for ColdFusion deployments.

Security feature bypass in Adobe ColdFusion 2023.18, 2025.6, and earlier allows remote unauthenticated attackers to circumvent security controls via improper input validation, potentially enabling unauthorized access to protected resources. The vulnerability carries a CVSS score of 7.5 with high integrity impact, though exploitation reportedly requires user interaction per the description. No public exploit code or active exploitation confirmed at time of analysis, but the authentication bypass classification indicates potential for privilege escalation or access control circumvention.

Insufficiently Protected Credentials in Adobe ColdFusion (versions 2025.4, 2023.16, and 2021.22 and earlier) enables unauthenticated remote attackers to gain limited unauthorized write access by exploiting improperly stored or transmitted credentials. The CVSS vector confirms network-accessible, zero-complexity exploitation with no privileges or user interaction required, producing limited integrity impact. Tagged as an Authentication Bypass vector, this vulnerability is distinct from a simple credential disclosure - it permits write operations, making it a meaningful integrity risk despite the moderate CVSS score. No public exploit or CISA KEV listing has been identified at time of analysis.

Arbitrary file read in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier stems from an XML External Entity (XXE) flaw (CWE-611) that lets remote unauthenticated attackers retrieve sensitive files from the server. Adobe rates the issue 8.6 (CVSS 3.1) with a scope change, and no public exploit is identified at time of analysis, though the description notes exploitation depends on conditions beyond the attacker's control.

XML External Entity (XXE) injection in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier allows remote attackers to read arbitrary files from the server filesystem via maliciously crafted XML documents requiring user interaction. The vulnerability achieves scope change (CVSS S:C), meaning exploitation can affect resources beyond the vulnerable component. Adobe has released patches in APSB25-105. No confirmed active exploitation (CISA KEV) or public POC identified at time of analysis. EPSS data not available.

ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to limited file system read. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Use of Hard-coded Credentials vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized access to sensitive systems or data. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of URLs. Exploitation of this issue does not require user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or bypass security measures. Exploitation of this issue does not require user interaction and scope is changed.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is restricted to internal IP addresses.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser, scope is changed. The vulnerable component is restricted to internal IP addresses.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is restricted to internal IP addresses.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is restricted to internal IP addresses.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitation of this issue does not require user interaction, and attack must have access to shared secrets.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensitive information or denial of service by bypassing security measures. Exploitation of this issue does not require user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution in the context of the current user. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 12.1% and no vendor patch available.

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 12.3% and no vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 26.4% and no vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 24.4% and no vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 28.4% and no vendor patch available.

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.