cbcvebase.
CVE-2025-43561
published 2025-05-13

CVE-2025-43561: ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution…

PriorityP265critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EPSS
12.60%
95.7th percentile
ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass authentication mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

Affected

4 ranges
VendorProductVersion rangeFixed in
adobecoldfusion<= 2021.19—
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.