Adobe ColdFusion is affected by a critical input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the host system.

This is an improper input validation vulnerability (CWE-20) that allows unauthenticated remote attackers to execute arbitrary code. The vulnerability does not require user interaction and impacts the system with a changed scope, meaning the attacker can potentially escape the application sandbox.

Successful exploitation of this vulnerability grants an attacker full control over the affected ColdFusion server. Given the CVSS score of 9.6, this represents a critical risk that could lead to complete system compromise, unauthorized data exfiltration, and significant operational downtime.

Immediate Action: Update Adobe ColdFusion 2025 to version 11 or later, and Adobe ColdFusion 2023 to version 22 or later.

Proactive Monitoring: Monitor server logs for suspicious payload patterns or unexpected process execution spawned by the ColdFusion service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious input patterns often associated with code execution attempts.

Public Exploit Available: No

This vulnerability presents a severe risk to organizational infrastructure. Administrators should prioritize patching immediately to eliminate the possibility of unauthorized remote code execution.