ColdFusion 2025 vulnerability

What happened

ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.

Affected versions

ColdFusion 2025: 0 through 2025.0.13 (custom); 0 through 2023.0.25 (custom) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.