CVE-2025-49546: Adobe ColdFusion · Improper Access Control
Affects Adobe ColdFusionSource CVE Database V5
Not known to be exploited · CVSS 2.4 Low.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 8 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Adobe ColdFusion | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-49546, European organizations should implement the following specific measures: 1) Restrict and monitor administrative and high-privileged access to ColdFusion servers strictly, ensuring only authorized personnel have such access. 2) Employ network segmentation and internal firewall rules to limit access to ColdFusion components to only necessary internal systems and users, reducing the attack surface. 3) Conduct regular audits of internal network access logs and ColdFusion application logs to detect unusual or unauthorized access attempts. 5) Implement robust internal security controls such as multi-factor authentication for privileged accounts and use of just-in-time access provisioning to minimize the window of exposure. 6) Prepare incident response plans that include scenarios of partial application denial-of-service to minimize operational impact. 7) Consider deploying application-layer protections or rate limiting to mitigate potential DoS effects internally.
Description
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service. A high-privileged attacker could exploit this vulnerability to partially disrupt the availability of the application. Exploitation of this issue does not require user interaction and scope is unchanged. The vulnerable component is restricted to internal IP addresses.