ColdFusion MX 6.1 users have the the ability to instantiate classes without using CreateObject() or <cfobject> tags and the security sandbox does not prevent this. This can compromise security in a shared, hosted environment.
Macromedia has provided a new patch to prevent this.
MPSB04-01 Security Patch Available for ColdFusion MX Sandbox Security (Macromedia, January 28, 2004)