Insufficiently Protected Credentials in ColdFusion by Adobe

CVE-2025-64898

What is CVE-2025-64898?

ColdFusion versions 2025.4, 2023.16, and 2021.22, as well as earlier variants, exhibit a vulnerability that allows attackers to exploit insufficiently protected credentials. This weakness can result in limited unauthorized write access, enabling attackers to gain entry without user interaction by leveraging improperly stored or transmitted credentials. Organizations using affected versions should take immediate action to mitigate the risk.

References