Adobe ColdFusion CVE-2026-21273

Exploitation requires two simultaneous conditions: (1) the attacker must already hold a low-privilege authenticated account on the targeted Adobe ColdFusion instance - confirmed by PR:L in the CVSS vector - meaning fully unauthenticated external attackers cannot exploit this directly without a prior foothold; and (2) a victim with higher privileges must actively open an attacker-crafted malicious file - confirmed by UI:R and explicitly stated in the CVE description. The file-open action is the explicit exploitation trigger. Factors limiting exploitation: the mandatory social engineering step (UI:R) prevents automated scanning or mass exploitation; the attacker must already be authenticated at low privilege, requiring a prior compromise or valid account acquisition; and only ColdFusion 2023 and 2025 release lines are listed as affected, so organizations on other versions should verify separately. There is no indication of a required non-default configuration - any ColdFusion 2023 or 2025 deployment where low-privileged users can interact with file content processed by higher-privileged sessions is potentially at risk.

The CVSS 3.1 score of 8.7 (High) is driven by network attack vector (AV:N), low complexity (AC:L), low privileges required (PR:L), scope change (S:C), and high confidentiality and integrity impact (C:H/I:H), partially offset by mandatory user interaction (UI:R). The user interaction requirement - the victim must open a malicious file - prevents fully automated or mass exploitation and is the single most significant real-world risk limiter; this is not a spray-and-pray vulnerability but one requiring targeted social engineering. No EPSS data was supplied, no KEV listing is present, and no public POC has been identified - all three signals suggest current exploitation risk is low-to-theoretical despite the high CVSS. The scope change remains the most serious concern: if triggered, exploitation is not contained within the ColdFusion process boundary, potentially enabling attacker reach into the broader server environment. Real-world priority should be elevated for ColdFusion deployments handling sensitive data or accessible to external or untrusted low-privileged accounts, but organizations without those conditions may deprioritize behind other KEV or actively exploited issues.

An attacker with a low-privilege account on the targeted ColdFusion instance crafts a file containing malformed input designed to bypass validation logic, then delivers it to a higher-privileged administrator or developer via email, internal file share, or collaboration platform and persuades them to open it within the ColdFusion context. When the victim opens the file, the improper input validation flaw is triggered, escalating the attacker's effective privileges across the security scope boundary and granting unauthorized read and write access to resources beyond the original application context. No public proof-of-concept has been identified at time of analysis, meaning successful exploitation currently requires attacker-developed exploit code.