Adobe ColdFusion 2025 contains an Eval Injection vulnerability (CWE-95) where directives in dynamically evaluated code are not properly neutralized. This weakness enables an attacker with low privileges to execute arbitrary code in the context of the current user. The vulnerability does not require user interaction to be exploited and impacts the security scope, potentially allowing full control over the affected system. The CVSS v3.1 base score is 9.9, reflecting critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially allowing an attacker to fully compromise the affected system's confidentiality, integrity, and availability. The vulnerability can be exploited remotely over the network without user interaction and requires only low privileges, increasing the risk of widespread impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor Adobe's security advisories for updates. No vendor-provided mitigation or temporary fix is currently documented.