Adobe ColdFusion has an input validation vulnerability (CVE-2025-61809) that allows…

10 December 2025 high vulnerability

Adobe ColdFusion has an input validation vulnerability (CVE-2025-61809) that allows attackers to bypass security features; patch immediately.

Japan's IPA (Information-technology Promotion Agency) has issued a security alert for Adobe ColdFusion, an application server platform. A critical input validation flaw tracked as CVE-2025-61809 has been identified that enables attackers to bypass security mechanisms. The advisory warns that exploitation of this vulnerability could lead to expanded damage and urges organizations to apply patches immediately following Adobe's published guidance. Adobe has released updated versions that address this vulnerability. Organizations running ColdFusion are advised to update to the latest patched version without delay to mitigate exploitation risk.

Mentioned in this report

Vulnerabilities CVE-2025-61809

Detection guidance

ColdFusion Server Process Spawning Command Shell

ATT&CK T1190

Detects the ColdFusion Java process spawning a command interpreter or scripting engine, a common post-exploitation pattern following abuse of input validation / RCE flaws such as CVE-2025-61809. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: ColdFusion Server Process Spawning Command Shell
id: cc059b36-3b6b-50e7-a5cf-2fab5a4b1259
status: experimental
description: Detects ColdFusion or its underlying Java/JRun process spawning cmd.exe,
  powershell.exe, or other script interpreters, which is consistent with exploitation
  of ColdFusion input validation/RCE vulnerabilities (e.g. CVE-2025-61809) leading
  to command execution.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \coldfusion.exe
    - \jrun.exe
    - \cfserver.exe
    - \java.exe
    ParentCommandLine|contains: coldfusion
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \certutil.exe
    - \mshta.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate ColdFusion administrative scripts or scheduled maintenance tasks that
  invoke shell utilities
- Custom ColdFusion applications calling out to OS commands via CFEXECUTE for approved
  business processes
level: high
tags:
- attack.t1190
- attack.execution

Web Shell File Dropped by ColdFusion Process

ATT&CK T1505.003

Detects creation of script/executable files (jsp, cfm, cfc, php, aspx, exe) by the ColdFusion service account/process in web-accessible directories, indicative of webshell deployment following exploitation of a ColdFusion vulnerability such as CVE-2025-61809. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Shell File Dropped by ColdFusion Process
id: 57e8ffb8-be53-5cc6-9780-14e3042fe263
status: experimental
description: Detects the ColdFusion server process writing new script or executable
  files into its web root or deployment directories, a common indicator of webshell
  drop after successful exploitation of a ColdFusion input validation / RCE flaw such
  as CVE-2025-61809.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \coldfusion.exe
    - \jrun.exe
    - \cfserver.exe
    TargetFilename|endswith:
    - .jsp
    - .jspx
    - .cfm
    - .cfc
    - .php
    - .aspx
    - .exe
    - .dll
  filter:
    TargetFilename|contains:
    - \WEB-INF\cftags\
    - \CFIDE\adminapi\
  condition: selection and not filter
falsepositives:
- Legitimate ColdFusion application deployment or update processes writing new .cfm/.cfc
  files
- Automated CI/CD pipelines pushing web application updates through the ColdFusion
  service account
level: medium
tags:
- attack.t1505.003
- attack.persistence

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20251211.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free