CVE-2025-49537
ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.
- Record
CVE-2025-49537- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2025-20706
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.
- Record
EUVD-2025-20706- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hf72-6m3v-v4jh
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper...
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.
- Record
GHSA-hf72-6m3v-v4jh- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.
- Record
CVE-2025-49537- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49537 is a high vulnerability (CVSS 7.9) in Adobe Coldfusion, published July 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.49%, the 84th percentile. No source names a fixed version.