Missing Authentication RCE in Adobe ColdFusion

Successful exploitation allows arbitrary code execution as the current user account running the vulnerable ColdFusion instance. This can enable execution of attacker-supplied commands or application logic, modification of application behavior, access to sensitive data available to that account, deployment of additional payloads, and potential follow-on compromise of connected systems or application resources. Because the scope is changed, exploitation may also affect assets beyond the immediately vulnerable component.

If immediate patching is not possible, reduce exposure of ColdFusion administrative and application interfaces to trusted networks only, enforce least privilege for the account running ColdFusion, and apply ColdFusion security configuration and lockdown guidance. Update supported JDK/JRE LTS releases, use the latest supported database connector components where applicable, and for JEE deployments apply the documented JVM serial filter settings. Additional defensive measures include application allowlisting, host-based detection and prevention controls, and close monitoring for suspicious execution activity originating from the ColdFusion service account.

Upgrade Adobe ColdFusion 2025 to Update 11 or later and Adobe ColdFusion 2023 to Update 22 or later. Apply the vendor security update on all affected deployments as a Priority 1 action. Adobe also recommends updating supported JDK/JRE installations to the latest supported update release and applying the documented ColdFusion security configuration and lockdown settings as part of remediation.