Cyber Resilience

CVE-2025-30286

HighRCE

Published: 08 April 2025

Published
08 April 2025
Modified
21 April 2025
KEV Added
Patch
CVSS Score v3.1 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0019 40.2th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-30286 is a high-severity OS Command Injection (CWE-78) vulnerability in Adobe Coldfusion. Its CVSS base score is 8.4 (High).

Operationally, ranked at the 40.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Deeper analysis

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier contain an OS command injection vulnerability (CWE-78) that permits arbitrary code execution. The flaw stems from improper neutralization of special elements in operating system commands and carries a CVSS 3.1 score of 8.4.

A high-privileged attacker can leverage the issue to bypass security protections and execute code on the affected server, although exploitation requires user interaction and results in a changed scope.

Adobe has published advisory APSB25-15 to address the vulnerability in ColdFusion.

The associated EPSS score rose from a low baseline to a peak of 0.0342 on 2026-02-04 before receding to its current value of 0.0019, indicating a period of increased exploitation interest after disclosure.

EU & UK References

Vulnerability details

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. A high-privileged attacker could leverage…

more

this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

adobe
coldfusion
2021, 2023, 2025

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References