CVE-2025-24446 is a critical improper input validation flaw (CVSS 9.1) in Adobe ColdFusion 2023.12, 2021.18, 2025.0 and earlier that can lead to code execution. It needs admin panel privileges. Adobe fixed it in bulletin APSB25-15, so install the updates listed there and restrict the admin panel.
What's affected
The NVD record names Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. Anything at or below those levels is affected. The description says exploitation needs no user interaction but does need admin panel privileges, and that scope is changed. The vector agrees: high privileges required, scope changed, and high impact across confidentiality, integrity and availability. In practice that means the flaw is most dangerous where the admin panel is reachable by people or networks it should not be.
The record is not on the CISA Known Exploited Vulnerabilities list.
The weakness is classed as CWE-20 (improper input validation). The score is 9.1 (CRITICAL). The vector, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, reads as reachable over the network, low attack complexity, high privileges required and no user interaction. Impact is high on confidentiality, high on integrity and high on availability. The record was published on 2025-04-08.
The record points to Adobe security bulletin APSB25-15 and gives no fixed version itself. I could not retrieve that page, so open it and read the update numbers for your line, which will be later than the versions above. Install the latest update for your major version.
How to check if you're exposed
ColdFusion reports its own update level, so the check is straightforward.
- Open the ColdFusion Administrator and read the server version and update level on its dashboard or system information page.
- Compare it with 2023.12, 2021.18 and 2025.0, which are the highest affected levels in the record, and with the fixed numbers in APSB25-15.
- Check who can reach the Administrator. It should be limited to a management network, a VPN or a short IP allowlist.
- Review the Administrator user list for accounts that are shared, stale or not needed.
- In the web server or load balancer configuration, confirm the admin path is not published to the internet.
Also check lock down guidance in Adobe's documentation for your version.
What to do now
- Read APSB25-15 and note the fixed update for each ColdFusion line you run.
- Apply the update in a test environment, then in production, and restart the service as the notes require.
- Restrict the ColdFusion Administrator to a management network or VPN.
- Remove unused admin accounts and set unique strong passwords.
- Review server logs for unexpected admin activity from before the update.
Why it matters
Improper input validation, listed as CWE-20, is a broad class: the software accepts input it should have rejected or cleaned, and later code acts on it. The record gives few details about the exact path, and the Adobe bulletin is where the specifics live, so read it for your version.
The need for admin privileges lowers the risk compared with an open flaw, but it does not remove it. Admin panels are often exposed more widely than intended, shared among teams, or protected by weak passwords. A flaw that turns admin access into code execution on the server and beyond (scope changed) deserves a patch window even in a well run shop.
If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Quick check
Does CVE-2025-24446 need a login?
Yes. The record says admin panel privileges are required. That makes it less urgent than a flaw anyone can reach, but you should still patch and keep the admin panel off the open internet.
Where do I find the fixed ColdFusion versions?
In Adobe security bulletin APSB25-15, linked in the record. I could not retrieve the page, so open it directly and match your version line.
Sources
- Safeguard Gold entry for CVE-2025-24446
- NVD record data for CVE-2025-24446 (published 2025-04-08)
- Adobe security bulletin APSB25-15 (listed in the record, could not be retrieved)
Last reviewed: 19 October 2026.
