What is the CVSS score of CVE-2026-21273?

CVE-2026-21273 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.9%.

Which versions of Adobe ColdFusion are affected by CVE-2026-21273?

Adobe ColdFusion 2023 and 2025 environments face a high-severity privilege escalation vulnerability (CVE-2026-21273, CVSS 8.7) that could allow attackers to gain unauthorized access to sensitive data…

How to fix or mitigate CVE-2026-21273?

Within 24 hours, identify all Adobe ColdFusion 2023 and 2025 instances and implement maximum input validation for file processing, restrict administrative access to essential personnel, and disable file upload features where operationally feasible. Within 7 days, deploy detection rules to identify privilege escalation attempts and file-processing anomalies, audit ColdFusion user accounts to remove unnecessary access, and minimize service account privileges to business-critical functions only. Within 30 days, establish continuous monitoring for Adobe security advisories and CVE-2026-21273 patch availability, prepare an upgrade plan for patched ColdFusion versions, and evaluate decommissioning legacy ColdFusion instances from critical systems.

Adobe ColdFusion CVE-2026-21273

EUVD-2026-56535 HIGH

Improper Input Validation (CWE-20)

2026-08-11 adobe

GHSA-m757-qg2g-x6hm

Privilege Escalation Adobe Coldfusion 2025 Coldfusion 2023

8.7

CVSS 3.1 · NVD

Severity by source

Vendor (adobe) PRIMARY

HIGH

qualitative

NVD

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

PR:L confirmed by low-privileged attacker requirement; UI:R confirmed by mandatory victim file-open action; S:C reflects cross-boundary privilege escalation; no availability impact described or implied.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (adobe).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 17:30 vuln.today

CVE Published

Aug 11, 2026 - 16:30 nvd

HIGH 8.7

DescriptionNVD

is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

AnalysisAI

Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthorized read and write access beyond their authorized security scope by exploiting improper input validation in file processing. The attack requires social engineering - a victim with higher privileges must open a specially crafted malicious file - after which the attacker's effective permissions cross security boundaries (scope change, S:C) to reach resources outside the original ColdFusion component. No public exploit or CISA KEV listing has been identified at time of analysis, though the high CVSS score of 8.7 and scope-change impact warrant prompt remediation per Adobe advisory APSB26-90.

Technical ContextAI

Adobe ColdFusion is a commercial Java-based rapid web application development platform using the ColdFusion Markup Language (CFML). The root cause is CWE-20 (Improper Input Validation): the application fails to adequately validate or sanitize user-supplied input within a file-processing code path, allowing attacker-controlled data to influence operations that are supposed to be restricted to higher privilege levels. The critical risk amplifier is the CVSS scope change (S:C), indicating that exploitation breaks out of the ColdFusion application's original security boundary and affects resources in a different security context - such as the underlying operating system or co-hosted components. Affected products confirmed by CPE are cpe:2.3:a:adobe:coldfusion_2025:*:*:*:*:*:*:*:* and cpe:2.3:a:adobe:coldfusion_2023:*:*:*:*:*:*:*:*, covering both current major release lines of the platform.

RemediationAI

Consult Adobe security advisory APSB26-90 (https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html) and apply the fixed update levels for ColdFusion 2023 and ColdFusion 2025 as documented there - exact patch build numbers are not independently confirmed in this analysis and must be obtained from the advisory. As a compensating control pending patching, restrict file upload and processing endpoints in ColdFusion to the minimum required set of authenticated, trusted users, and audit access control lists on all file-handling actions to limit the attacker foothold (PR:L) that this vulnerability requires. Email and file-sharing gateway policies that quarantine or block unexpected files sent to ColdFusion-processing users reduce the social engineering surface inherent to the UI:R vector. Implement network segmentation around ColdFusion servers to constrain scope-change impact if exploitation occurs; note that overly restrictive file-handling rules may break legitimate application workflows and should be tested in staging before production rollout.