CVE-2013-0625: Adobe ColdFusion authentication bypass when no password is set

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8, confirmed in-the-wild exploitation, KEV listing and near-maximum EPSS make this an urgent patch-or-isolate case.

What it is

Adobe ColdFusion 9.0, 9.0.1 and 9.0.2 allow remote attackers to bypass authentication when a password is not configured, and possibly execute arbitrary code via unspecified vectors. The flaw was exploited in the wild in January 2013, and the record does not specify the exact request path or component involved.

Impact

An unauthenticated remote attacker gains access that bypasses authentication and may be able to execute arbitrary code on the ColdFusion server. Successful exploitation can lead to full compromise of the host and any data it processes.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description does not identify the specific endpoint or interface used, only that the condition depends on a password not being configured.

Exploitation

CVE-2013-0625 is listed in CISA KEV (added 2022-03-07) and the description states it was exploited in the wild in January 2013; EPSS is 0.93797 (99.8th percentile), indicating very high predicted exploitation activity. No ransomware campaign use is documented in the record.

What to do

• Apply the vendor updates referenced in Adobe security advisory APSA13-01 and bulletin APSB13-03, or upgrade to a supported ColdFusion release.
• Ensure an administrative password is configured on all ColdFusion instances, since the flaw requires a password not to be set.
• Restrict network access to ColdFusion administrative and exposed services to trusted hosts only.
• If the affected 9.0.x versions cannot be patched or upgraded, isolate or retire the instance.

Detection

• Review ColdFusion server and web logs for unauthenticated requests to administrative or login endpoints that succeed without prior authentication.
• Audit ColdFusion configuration to confirm whether an administrator password is set on each instance.
• Monitor for unexpected process execution or child processes spawned by the ColdFusion service.
• Alert on exploitation attempts matching known ColdFusion authentication bypass patterns from threat intelligence feeds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.