Adobe has released updates for 32 ColdFusion vulnerabilities, including flaws that can lead to unauthenticated code execution, server-side request forgery (SSRF), XML external entity (XXE) abuse, denial-of-service, and Remote Development Services (RDS) path traversal. NCSC-NL said the SSRF bugs can bypass network segmentation and reach internal systems without user interaction.
The mixed bug set matters because the server itself becomes the bridge: SSRF can make ColdFusion fetch internal resources, while code-injection and upload flaws can make it run attacker-controlled code. The RDS path-traversal issue can expose arbitrary files, so the impact is not limited to the application tier.
For internet-facing ColdFusion deployments, the exposure sits wherever the app server can see internal services or file-backed data. If ColdFusion is part of that trust boundary, patching removes the flaw but not the fact that the server was able to reach more than the app once compromised.
1 source · 1 day ago
CVEs in this update
32 CVEs
Across ColdFusion, ColdFusion 2025, ColdFusion 2023, and related packages.