CVE-2025-34074Disclosure

LOWCVSS 9.4 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled server, which is written to the Lucee webroot and executed with the privileges of the Lucee service account. Because Lucee does not enforce integrity checks, path restrictions, or execution controls for scheduled task fetches, this feature can be abused to achieve arbitrary code execution. This issue is distinct from CVE-2024-55354.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-94CWE-829

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://zerodaysignal.com/vulnerability/CVE-2025-34074

Full discourse1 post

0day Signal@0dayPublishing201d
Disclosure
🚨 CVE-2025-34074: Lucee Admin Interface Authentica... Lucee's scheduled task feature is basically a built-in backdoor - fetch remote CFM, drop to webroot, execute with servi... https://zerodaysignal.com/vulnerability/CVE-2025-34074 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE-2025-34074 exposes a Lucee admin scheduled task feature that functions as a backdoor for remote code execution, with technical details provided and a link to a vulnerability page.
00000106
162 followersView on X

Explore more

Back to dashboard