CVE-2021-40699: Adobe ColdFusion

High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days.

ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.

Affected products

• Adobe ColdFusion: before 2018 (fixed in 2018); version 2018 only; version 2021 only

Published 2023-09-07. Last modified 2026-06-17.