EUVD-2026-100506
GHSA-24gc-q93c-9xjp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ColdFusion endpoint
-
DeliverySend malformed/crafted input
-
ExploitTrigger input-validation failure
-
ExecutionApplication crashes
-
ImpactDenial-of-service outage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires network reachability to an Adobe ColdFusion application instance (ColdFusion 2025 ≤2025.0.13 or ColdFusion 2023 ≤2023.0.25) that processes attacker-supplied input through the vulnerable improper-input-validation code path. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the statement that exploitation does not require user interaction, no authentication, no credentials, and no victim action are needed against a reachable instance. The practical limiting factor is exposure: internet-facing or otherwise attacker-reachable ColdFusion servers are at risk, while instances restricted to trusted internal networks sharply reduce reachability. Impact is limited to availability (application crash / DoS) - no confidentiality or integrity consequence - so the realistic worst case is service outage, not compromise. |
| Impact | This is a genuine but bounded-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a remotely reachable, low-complexity, unauthenticated flaw with no user interaction, which explains the 7.5 score - but all of that severity derives solely from availability impact (A:H), with zero confidentiality or integrity impact. This is an availability-only denial-of-service (CWE-20 improper input validation), not a code-execution or data-exposure bug, so it is a service-reliability risk rather than a breach risk. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The only reference is the Adobe PSIRT advisory (APSB26-144), which is consistent with a vendor-coordinated disclosure rather than observed in-the-wild exploitation. Net: prioritize patching on internet-facing ColdFusion instances because the vector is trivially remote and unauthenticated, but this is not an RCE-grade emergency - treat it as a high-availability-impact DoS. Signals are internally consistent; the main missing data points are EPSS and any exploitation telemetry. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted input to an internet-facing ColdFusion server that fails improper input validation, causing the application to crash and become unavailable. No user interaction or credentials are needed, so the request can be repeated to sustain an outage. No public proof-of-concept is currently referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated denial of service in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows a remote attacker to crash the application by sending crafted input that the server fails to validate properly. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials and no victim interaction are required against a reachable instance, and the impact is confined to availability (C:N/I:N/A:H) - the practical worst case is a service outage rather than data exposure or code execution. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the dominant risk factor is exposure, since internet-facing or otherwise attacker-reachable ColdFusion instances are at risk while internally segmented deployments sharply reduce reachability.
RemediationAI
Treat the referenced Adobe bulletin APSB26-144 (https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html) as the authoritative fix source and apply the ColdFusion update it prescribes for the 2025.0.x and 2023.0.x branches; the released patched version is not independently confirmed from the provided data, so verify the exact fixed build number against the bulletin before closing the finding. Because the vulnerability is only exploitable by a network-reachable client, the most effective compensating control before patching is to remove ColdFusion instances from untrusted exposure - place them behind a reverse proxy or WAF with request size and rate limits, allow only required source networks to reach the connector ports and application endpoints, and block direct internet access to the ColdFusion Administrator and internal services; the trade-off is that this constrains legitimate remote and partner access and requires maintaining allow-lists. Additional interim measures include enabling request throttling and connection limits on the web server front end (which can throttle legitimate high-volume traffic), keeping ColdFusion error pages from leaking stack traces, and monitoring application logs and process uptime for crash/restart patterns so that a DoS attempt is detected early. Note that these are mitigations only - none of them fixes the underlying improper input validation, so patching remains required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-20 (Improper Input Validation) in Adobe ColdFusion, a Java-based commercial application server and Rapid Application Development platform used to host CFML/REST applications. Root cause is the failure to adequately validate attacker-supplied input before it is processed by an application code path, which allows a crafted request to drive the server into an unrecoverable state (application crash / denial of service). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms a network-reachable, low-complexity, unauthenticated, no-user-interaction attack that affects only availability, with no scope change and no confidentiality or integrity impact. Because the vulnerable behavior sits in the request-processing path rather than in an authentication or authorization control, the attack surface is effectively any ColdFusion endpoint that accepts external input on the affected 2025.0.x and 2023.0.x branches. No CPE identifiers were supplied with the intelligence data, so affected-product scoping relies on the EUVD version ranges rather than on NVD CPE configuration strings.
Know when Coldfusion gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, unauthenticated, no user interaction crash of the app yields AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H) and no confidentiality or integrity effect.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
Executive ViewAI
Adobe ColdFusion 2025 up to 2025.0.13 and ColdFusion 2023 up to 2023.0.25 are affected by an unauthenticated remote denial-of-service flaw that can crash reachable instances and cause service outages. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, so the dominant business risk is exposure of internet-facing or attacker-reachable ColdFusion services rather than data compromise or code execution. Leadership should prioritize reducing reachability and preparing continuity plans for potential outages affecting customer-facing or internal applications.
No vendor-released patch identified at time of analysis; restrict network access to trusted sources, deploy WAF/IPS rules to block crafted input, segment affected ColdFusion instances, enforce rate limiting, and monitor for availability anomalies until a patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote attacker upload a fi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Exploit-DB