Adobe released a security patch yesterday:

Patch available for ColdFusion MX 7 information disclosure issue

For some reason this isn't yet on the production notification feed but you can find it on the Security bulletins page. (Did you know about that page?)