CVE-2025-30286
Published: 08 April 2025
Summary
CVE-2025-30286 is a high-severity OS Command Injection (CWE-78) vulnerability in Adobe Coldfusion. Its CVSS base score is 8.4 (High).
Operationally, ranked at the 40.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier contain an OS command injection vulnerability (CWE-78) that permits arbitrary code execution. The flaw stems from improper neutralization of special elements in operating system commands and carries a CVSS 3.1 score of 8.4.
A high-privileged attacker can leverage the issue to bypass security protections and execute code on the affected server, although exploitation requires user interaction and results in a changed scope.
Adobe has published advisory APSB25-15 to address the vulnerability in ColdFusion.
The associated EPSS score rose from a low baseline to a peak of 0.0342 on 2026-02-04 before receding to its current value of 0.0019, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-11913
Vulnerability details
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. A high-privileged attacker could leverage…
more
this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.