CVE-2025-43565

HIGH

Adobe ColdFusion <= 2025.1, <= 2023.13, <= 2021.19 - Authenticated Arbitrary Code Execution via Incorrect Authorization

Title source: llm
STIX 2.1

Description

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.

References (1)

Core 1
Core References

Scores

CVSS v3 8.4
EPSS 0.0358
EPSS Percentile 87.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-863
Status published
Products (3)
adobe/coldfusion 2021 (20 CPE variants)
adobe/coldfusion 2023 (14 CPE variants)
adobe/coldfusion 2025 (2 CPE variants)
Published May 13, 2025
Tracked Since Feb 18, 2026