CVE-2025-43561

Adobe ColdFusion versions 2025.1, 2023.13, and 2021.19 and earlier contain an Incorrect Authorization flaw (CWE-863) that allows a high-privileged attacker to bypass authentication mechanisms. The issue is network-triggered (AV:N), requires no user interaction, and is rated with changed scope, meaning successful exploitation can affect resources beyond the vulnerable component. An attacker leveraging the flaw gains arbitrary code execution in the context of the current user, i.e., code execution on the ColdFusion server itself. Any organization running the affected 2025, 2023, or 2021 update lines is exposed, particularly on internet-facing servers. No public proof-of-concept or CISA KEV listing is known yet, but the 20.6% EPSS score (97th percentile) indicates a significant probability of exploitation within 30 days.

What to do: Upgrade all ColdFusion installations to the fixed releases published in Adobe's security advisory, i.e., versions later than 2025.1, 2023.13, and 2021.19 on their respective release lines; prioritize internet-facing servers given the network vector and high EPSS. Until patched, restrict access to ColdFusion administrative and privileged interfaces to trusted networks and audit accounts holding high privileges on ColdFusion servers. Monitor the Adobe advisory for fixed version numbers and any added exploitation reports.