CVE-2025-43561

CRITICAL

ColdFusion 2025.1 2023.13 2021.19 and earlier - Authenticated Remote Code Execution via Authorization Bypass

Title source: llm
STIX 2.1

Description

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass authentication mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

References (1)

Core 1
Core References

Scores

CVSS v3 9.1
EPSS 0.0181
EPSS Percentile 83.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-863
Status published
Products (3)
adobe/coldfusion 2021 (20 CPE variants)
adobe/coldfusion 2023 (14 CPE variants)
adobe/coldfusion 2025 (2 CPE variants)
Published May 13, 2025
Tracked Since Feb 18, 2026