CVE-2016-4264

This issue is like a “badly designed file parser” inside ColdFusion. If someone sends a specially crafted Excel-style file, ColdFusion can be tricked into pulling data from your server or reaching into your internal network instead of just processing the spreadsheet normally.

This matters if you run Adobe ColdFusion 10 or Adobe ColdFusion 11 and you have not installed the vendor updates listed for Update 21 (ColdFusion 10) or Update 10 (ColdFusion 11). Because the attacker comes from the network and does not need a login, internet-exposed ColdFusion features that process Office/OOXML files are at particular risk.
It’s primarily a risk when the vulnerable OOXML processing path is reachable from the attacker’s network (for example, through a web endpoint that accepts OOXML/Excel inputs).

This is AMBER because public exploits are available and the likelihood of successful attacks is high for this kind of issue. Even though it isn’t in the CISA KEV list, the pressure and exploit maturity indicated by public weaponization means you should patch, not wait. Prioritize systems exposed to the internet and any functionality that accepts or imports OOXML spreadsheets.