CVE-2025-30281

Adobe ColdFusion releases 2025.0, 2023.12, 2021.18 and all earlier versions contain an improper access control flaw (CWE-284) that can result in arbitrary code execution. The flaw is reachable over the network without any user interaction, but the attacker must already hold high privileges on the target (CVSS 9.1 with PR:H), and successful exploitation changes the security scope, letting the attacker break beyond the ColdFusion authorization boundary. A successful attacker can access or modify sensitive data without proper authorization and execute arbitrary code on the server. Any organization running the affected ColdFusion release lines is in scope, though the requirement for high-privilege access reduces practical exposure relative to unauthenticated ColdFusion flaws. It is not yet in CISA KEV and no public proof-of-concept is known, but EPSS assigns a 22.5% probability of exploitation within 30 days (98th percentile), so active exploitation should be treated as a realistic near-term risk.

What to do: Update every ColdFusion 2021, 2023 and 2025 instance to the latest update release per Adobe's advisory, which ships in a batch of 30 fixes (11 critical). Until patched, restrict network access to ColdFusion Administrator and server endpoints, enforce strong and rotated admin credentials, and audit which accounts hold the high-privilege access that exploitation requires. Given the elevated EPSS score, prioritize internet-facing servers and monitor for anomalous admin activity or unexpected process execution on ColdFusion hosts.