Adobe ColdFusion (versions 2025.9, 2023.20 and earlier)
A commercial platform used by developers to build and deploy enterprise websites and web applications.
Root Cause
The flaw requires no authentication and no user interaction to trigger. An attacker simply sends a crafted request to the server. The underlying failure is in how ColdFusion handles external input before verifying who is sending it, allowing code execution before any identity check occurs.
Attack Vector
Exploitation began within two hours of Adobe's public disclosure, captured by KEVIntel's global honeypot network. An attacker sends a malicious HTTP request to an exposed ColdFusion instance, gains code execution, and can subsequently read files, install backdoors, or pivot deeper into the network. No credentials needed.
Detection Notes
Look for unexpected outbound connections from your ColdFusion server, unusual process spawning from the ColdFusion service account, and unfamiliar files written to the web root directory.
Recommended Actions
- Apply Adobe's patch immediately — the 72-hour window has already passed for most organisations.
- Place ColdFusion servers behind a web application firewall (WAF) if not already done.
- Restrict external access to ColdFusion admin interfaces at the network level.