CVE-2025-43564 is a critical (CVSS 9.1) incorrect authorization flaw in Adobe ColdFusion 2025.1, 2023.13, 2021.19 and earlier that could allow arbitrary file system read. A high privileged attacker is needed. Update to the release named in Adobe security bulletin APSB25-52.
What's affected
The record lists ColdFusion versions 2025.1, 2023.13 and 2021.19 and earlier as affected. Each number is the highest affected update in its release line, so anything at or below it is in scope.
Adobe's bulletin is APSB25-52. I could not retrieve it while preparing this post, so confirm the exact fixed update numbers for each line there. Do not guess them from the pattern above. The sibling entry CVE-2025-43563 appears in the same bulletin and covers the same product, so both are cleared by the same update.
The description says a high privileged attacker could read or modify sensitive data without proper authorization, that exploitation needs no user interaction, and that the scope is changed. Scope change means the impact can reach beyond the ColdFusion component itself.
How to check if you're exposed
Find every ColdFusion server, including development and staging instances. In the ColdFusion Administrator, the server version and update level appear on the system information page.
From the command line on the server, the installation directory contains the version information, and your configuration management tool may already record it. Compare each line against the fixed update in APSB25-52.
Then look at who holds high privileges. Because the attack requires a high privileged account, review the administrator and RDS style accounts on each instance, check that the Administrator is not reachable from the internet, and look at recent logins for anyone unexpected.
What to do now
- List all ColdFusion instances and their update levels.
- Read Adobe bulletin APSB25-52 and note the fixed update for each release line you run.
- Apply the update on development and staging first, test the main applications, then roll it to production.
- Restrict the ColdFusion Administrator to a management network or VPN and remove unused administrator accounts.
- Run the server process as a dedicated, low privilege service account and limit which folders it can read.
- Review the lockdown guide Adobe publishes for your version, and rotate secrets stored in readable configuration files if you suspect exposure.
Why it matters
The weakness is classed as CWE-863 (Incorrect Authorization). The record uses broad language, so the exact check that fails is not public in the description. What matters is the outcome: a path that lets a privileged caller read files on the server beyond what the application intends.
Arbitrary file read on an application server is serious even when it needs privileges. Configuration files, data source passwords, keys and source code usually sit on the same disk. An attacker who reads them can turn one flaw into broader access, which is why the vector marks the scope as changed.
The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. ColdFusion has a long history of attention from attackers, so treat the update as routine but not optional.
Quick check
Do I need a high privileged account for this to matter?
The vector says high privileges are required. That lowers the odds compared with an anonymous flaw, but administrator accounts are often weakly protected, so patch and tighten access.
Does one update fix both CVEs?
Both entries point to the same Adobe bulletin, APSB25-52. Confirm in the bulletin that the update you apply covers CVE-2025-43564 and CVE-2025-43563.
Sources
Last reviewed: 18 October 2026.
