CVE-2025-49546: 
Adobe ColdFusion vulnerability analysis and mitigation

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service. The vulnerability was discovered and disclosed on July 8, 2025, and was assigned CVE-2025-49546. The vulnerable component is restricted to internal IP addresses (NVD CVE).

The vulnerability is classified as an Improper Access Control issue (CWE-284). It has been assigned a CVSS v3.1 Base Score of 2.4 (LOW) with the vector string CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L. The scoring indicates that the vulnerability requires adjacent network access, has low attack complexity, requires high privileges, needs no user interaction, has unchanged scope, and can only impact availability at a low level (NVD CVE).

If exploited, this vulnerability could lead to a partial disruption of the application's availability. The impact is limited to availability with no effect on confidentiality or integrity of the system. The scope of the vulnerability remains unchanged, meaning the impacted component is the same as the vulnerable component (NVD CVE).

Adobe has released security updates to address this vulnerability. Users should update their ColdFusion installations to versions newer than 2025.2, 2023.14, or 2021.20 depending on their current version track (Adobe Advisory).