BaseFortify

Publication date: 2025-12-10

Last updated on: 2026-06-29

Assigner: Adobe Systems Incorporated

Description

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain unauthorized access by exploiting improperly stored or transmitted credentials. Exploitation of this issue does not require user interaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-10

Last Modified

2026-06-29

Generated

2026-07-06

AI Q&A

2025-12-10

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64898

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	coldfusion	2021.22
adobe	coldfusion	2023.16
adobe	coldfusion	2025.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability in ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier involves insufficiently protected credentials. It means that credentials are improperly stored or transmitted, allowing an attacker to gain limited unauthorized write access without requiring user interaction.

Impact Analysis

The vulnerability could allow an attacker to gain unauthorized access and perform limited unauthorized write actions, potentially compromising the integrity of the affected system or data.

Hi! I’m here to help you understand CVE-2025-64898. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70