EUVD-2026-56547
GHSA-h7h3-4972-69f5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-exploitable with no authentication or interaction required; C:H reflects unauthorized read access, I:L reflects limited write capability, A:N as no availability impact is described.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.
AnalysisAI
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security controls, gaining unauthorized read and limited write access to affected systems. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a low-complexity, network-exploitable flaw requiring no privileges or user interaction, elevating real-world risk for any internet-facing ColdFusion deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but ColdFusion's history as a high-value target warrants prompt patching.
Technical ContextAI
Adobe ColdFusion is a commercial application server and CFML-based web development platform widely used in enterprise environments. CWE-20 (Improper Input Validation) indicates the root cause is insufficient sanitization or validation of attacker-supplied input, allowing crafted requests to circumvent one or more security enforcement mechanisms. In ColdFusion's context, this class of flaw commonly manifests in request filtering, authentication gates, or access control enforcement layers that fail to properly reject or sanitize malformed inputs. Affected products confirmed via CPE are cpe:2.3:a:adobe:coldfusion_2025 and cpe:2.3:a:adobe:coldfusion_2023, covering all versions of both major release lines. The scope is unchanged (S:U), meaning the vulnerability is contained within the ColdFusion process boundary, but the high confidentiality impact (C:H) suggests access to sensitive server-side data or configuration.
RemediationAI
Apply the update issued by Adobe under security bulletin APSB26-90, available at https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html. Exact fixed build numbers are not independently confirmed in the available input data and must be verified directly in the advisory. While patching is underway, organizations should consider restricting network access to ColdFusion administrator interfaces and the ColdFusion server itself to trusted IP ranges, as this reduces the network attack surface for unauthenticated exploitation. Additionally, deploying a Web Application Firewall (WAF) with rules targeting ColdFusion-specific request patterns can provide a compensating control, though WAF bypass is possible and this should not be treated as a permanent substitute for patching. Disabling unused ColdFusion features and endpoints may further reduce exposure if operationally feasible.
More in Coldfusion 2025
View allOS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary op
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorizati
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthoriz
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrat
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authoriz
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass securit
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitra
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptogra
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security co
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today