Cyber Resilience

CVE-2025-43562

CriticalRCE

Published: 13 May 2025

Published
13 May 2025
Modified
19 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0774 92.1th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-43562 is a critical-severity OS Command Injection (CWE-78) vulnerability in Adobe Coldfusion. Its CVSS base score is 9.1 (Critical).

Operationally, ranked in the top 7.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier contain an OS command injection vulnerability tracked as CVE-2025-43562 and assigned CWE-78. The flaw stems from improper neutralization of special elements in operating system commands and carries a CVSS 3.1 score of 9.1, reflecting network-accessible attack vectors that require high privileges but no user interaction and that change scope.

A high-privileged attacker can exploit the issue remotely to bypass security controls and execute arbitrary code in the context of the current user, potentially leading to full compromise of confidentiality, integrity, and availability on the affected ColdFusion instance.

The official Adobe advisory at https://helpx.adobe.com/security/products/coldfusion/apsb25-52.html addresses mitigation steps and patch availability for the listed versions. The associated EPSS score remains low, with a current value of 0.0774 and a peak of 0.0841.

EU & UK References

Vulnerability details

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A…

more

high-privileged attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

adobe
coldfusion
2021, 2023, 2025

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References