CVE-2025-49544: Adobe ColdFusion · XXE
Affects Adobe ColdFusionSource CVE Database V5
Not known to be exploited · CVSS 6.8 Medium.
Data as of 26 Oct 2026, 13:47 UTC
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 54% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 8 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Adobe ColdFusion | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-49544, European organizations should take the following specific actions: 1) Immediately identify all instances of Adobe ColdFusion in their environment, including versions 2025.2, 2023.14, 2021.20, and earlier. 2) Apply official patches or updates from Adobe as soon as they become available; if no patches are currently released, implement temporary mitigations such as disabling XML external entity processing in ColdFusion configuration or restricting XML parser features to prevent external entity resolution. 3) Restrict access to ColdFusion administrative interfaces and services to trusted networks and authenticated users with the principle of least privilege. 4) Monitor logs and network traffic for unusual XML payloads or attempts to exploit XXE vulnerabilities, using intrusion detection systems or web application firewalls with updated signatures. 5) Conduct a thorough review of application code and integrations that process XML inputs to ensure proper validation and sanitization of XML data. 6) Implement network segmentation to limit the potential lateral movement of attackers exploiting this vulnerability. 7) Educate system administrators and developers about the risks of XXE and secure XML processing practices. 8) Prepare incident response plans to quickly address any detected exploitation attempts.
Description
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or bypass security measures. Exploitation of this issue does not require user interaction and scope is changed.