Cyber Posture

CVE-2025-61821

Medium

Published: 10 December 2025

Published
10 December 2025
Modified
12 December 2025
KEV Added
Patch
CVSS Score 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.0003 9.9th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Security Summary

CVE-2025-61821 is an Improper Restriction of XML External Entity Reference (XXE) vulnerability, classified under CWE-611, affecting Adobe ColdFusion versions 2025.4, 2023.16, 2021.22, and earlier. Published on 2025-12-10, this flaw allows arbitrary file system reads, enabling attackers to access sensitive files and data on the server. The vulnerability carries a CVSS v3.1 base score of 6.8 (Medium), with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating network accessibility, high attack complexity, no privileges or user interaction required, a change in scope, and high confidentiality impact.

Unauthenticated attackers can exploit this vulnerability remotely over the network without user interaction. Successful exploitation grants read access to arbitrary files on the server, potentially exposing sensitive data such as configuration files, credentials, or other confidential information, while leaving integrity and availability unaffected.

Adobe's security bulletin APSB25-105, available at https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html, provides details on mitigation, including recommended patches for affected ColdFusion versions.

Details

CWE(s)
CWE-611

Affected Products

adobe
coldfusion
2021, 2023, 2025

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
Why these techniques?

XXE in public-facing ColdFusion enables initial access via exploit of public app (T1190) and facilitates arbitrary file reads for data collection from local system (T1005), including credentials in files (T1552.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References