CVE-2025-61821 is an Improper Restriction of XML External Entity Reference (XXE) vulnerability in Adobe ColdFusion. It affects versions 2025.4, 2023.16, 2021.22 and earlier. The vulnerability allows an unauthenticated attacker to read arbitrary files on the server by exploiting XML parsing functionality. Exploitation does not require user interaction but depends on external conditions. The vulnerability impacts confidentiality but does not affect integrity or availability. No patch or remediation information is provided in the available data.

Successful exploitation can lead to unauthorized disclosure of sensitive files and data on the affected server, impacting confidentiality. There is no indication of integrity or availability impact. The attack does not require user interaction and can change the security scope, potentially allowing access beyond the attacker's original privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, monitor vendor communications for updates and consider restricting XML input sources or disabling XML external entity processing if possible as a temporary mitigation.