Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that could allow an attacker to execute arbitrary code in the context of the current user. The flaw exists in a component restricted to an administrative network zone by default. Exploitation does not require user interaction or privileges, increasing the risk of remote exploitation within the administrative network. The CVSS v3.1 score is 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability. No patch or official remediation has been published as of the advisory date.

Successful exploitation could lead to arbitrary code execution with high impact on confidentiality, integrity, and availability of the affected system. Since the vulnerable component is limited to an administrative network zone, exploitation is likely constrained to attackers with network access to that zone. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the administrative zone and monitor for unauthorized activity. No vendor-provided mitigation or temporary fix is currently documented.