CVE-2025-64898 affects Adobe ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier. It is an Insufficiently Protected Credentials vulnerability (CWE-522) that could lead to limited unauthorized write access. The issue arises from credentials that are improperly stored or transmitted, allowing an attacker to leverage this weakness without requiring user interaction. The CVSS 3.1 base score is 4.3 (medium severity), with attack vector network, low attack complexity, no privileges required, and user interaction required. No patch or vendor advisory details are currently provided.

The vulnerability could allow an attacker to gain limited unauthorized write access to the affected ColdFusion systems by exploiting improperly protected credentials. There is no indication of confidentiality or availability impact, and no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, organizations should monitor Adobe's security advisories for updates. Until a fix is available, consider reviewing credential storage and transmission practices in ColdFusion environments to reduce exposure.