Adobe Patches 11 Critical ColdFusion Flaws Amid 30 Total Vulnerabilities Discovered

Adobe ColdFusion releases 2025.0, 2023.12, 2021.18 and all earlier versions contain an improper access control flaw (CWE-284) that can result in arbitrary code execution. The flaw is reachable over the network without any user interaction, but the attacker must already hold high privileges on the target (CVSS 9.1 with PR:H), and successful exploitation changes the security scope, letting the attacker break beyond the ColdFusion authorization boundary. A successful attacker can access or modify sensitive data without proper authorization and execute arbitrary code on the server. Any organization running the affected ColdFusion release lines is in scope, though the requirement for high-privilege access reduces practical exposure relative to unauthenticated ColdFusion flaws. It is not yet in CISA KEV and no public proof-of-concept is known, but EPSS assigns a 22.5% probability of exploitation within 30 days (98th percentile), so active exploitation should be treated as a realistic near-term risk.

Do: Update every ColdFusion 2021, 2023 and 2025 instance to the latest update release per Adobe's advisory, which ships in a batch of 30 fixes (11 critical). Until patched, restrict network access to ColdFusion Administrator and server endpoints, enforce strong and rotated admin credentials, and audit which accounts hold the high-privilege access that exploitation requires. Given the elevated EPSS score, prioritize internet-facing servers and monitor for anomalous admin activity or unexpected process execution on ColdFusion hosts.

After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Bridge versions 14.1.5, 15.0.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Media Encoder versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Premiere Pro versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Animate versions 24.0.7, 23.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.