CVE-2026-25652 is an Incorrect Authorization vulnerability in Adobe ColdFusion 2025. This flaw permits a low-privileged attacker to escalate privileges by obtaining unauthorized read and write access to resources. The vulnerability can be exploited without any user interaction, increasing its risk. The CVSS 3.1 vector indicates the attack requires local access with low complexity and privileges, and it impacts confidentiality, integrity, and availability with high severity. No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation results in privilege escalation, allowing unauthorized read and write access to sensitive data or system components. This impacts confidentiality, integrity, and availability of the affected system, potentially enabling further compromise or disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, monitor Adobe's advisories for updates. Until a patch is available, restrict local access to trusted users only to reduce risk.