Skip to main content
CRITICAL

CVE-2025-43563

CVSS v3

9.1

CRITICAL

EPSS Score

15.3 %

exploit probability, as of 2026-09-25

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Description

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed.

Technical details

Published
2025-05-13
Last Modified
2025-07-15

Frequently asked questions

What is CVE-2025-43563?

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed.

Is CVE-2025-43563 actively exploited?

Active exploitation of CVE-2025-43563 has not been confirmed. Its EPSS score was 15.3% on 2026-09-25, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-43563?

CVE-2025-43563 has a CVSS v3 base score of 9.1 (CRITICAL severity).

Is CVE-2025-43563 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2025 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database