Latest Adobe ColdFusion vulnerabilities #
On April 8, 2025, Adobe disclosed (via bulletin ID APSB25-15) multiple vulnerabilities in their ColdFusion rapid application development product that could allow an attacker to execute arbitrary code on vulnerable systems, or disclose the contents of arbitrary files.
What is the impact? #
Successfully exploiting one of these vulnerabilities could allow an attacker to execute arbitrary code on the vulnerable system, or disclose the contents of arbitrary files.
ColdFusion 2021, 2023, and 2025 are vulnerable.
Are updates or workarounds available? #
Adobe has released updates that address these vulnerabilities and users are advised to upgrade as quickly as possible.
How do I find potentially vulnerable systems with runZero? #
From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:
product:ColdFusion
