---
id: CVE-2025-64898
title: >-
  ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an
  Insufficiently Protected Credentials vulnerability that could result in
  limited unauthorized write access
summary: >-
  ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an
  Insufficiently Protected Credentials vulnerability that could result in
  limited unauthorized write access. An attacker could leverage this
  vulnerability to gain …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-522
vendor: adobe
product: coldfusion
affected:
  - coldfusion = 2021
  - coldfusion = 2023
  - coldfusion = 2025
published: '2025-12-10'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T23:10:00.463'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-64898'
references:
  - url: 'https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html'
    label: psirt@adobe.com
tags:
  - nvd
epss: 0.00438
epssPercentile: 0.3547
ingestedAt: '2026-06-29T13:24:34.618Z'
---

## Overview

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain unauthorized access by exploiting improperly stored or transmitted credentials. Exploitation of this issue does not require user interaction.

## Affected

- `coldfusion = 2021`
- `coldfusion = 2023`
- `coldfusion = 2025`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.