EUVD-2026-56547
GHSA-h7h3-4972-69f5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing ColdFusion 2023/2025 instance
-
DeliverySend crafted HTTP request with malformed or unexpected input
-
ExploitTrigger input validation failure in security enforcement layer
-
ExecutionBypass authentication or access control gate
-
PersistRead sensitive server-side data
-
ImpactPerform limited unauthorized write operations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | No special conditions are required for exploitation based on the CVSS vector (AV:N/AC:L/PR:N/UI:N): this is a remote, unauthenticated attack against default or standard configurations of Adobe ColdFusion 2023 and 2025 accessible over the network. The absence of AC:H or PR:L/PR:H indicates no specific non-default configuration, credentials, or target user action is needed. Exploitation is limited to ColdFusion 2023 and 2025 release lines - ColdFusion 2021 and earlier are not listed as affected in available CPE data. Organizations that have restricted ColdFusion server access to internal networks or VPN reduce exposure, as network reachability is the sole prerequisite. |
| Impact | The CVSS 8.2 base score is well-supported by the vector metrics: AV:N (network-exploitable), AC:L (no special conditions), PR:N (no authentication required), UI:N (no victim interaction), C:H (high confidentiality breach), I:L (limited integrity impact), A:N (no availability impact). These metrics paint a high-priority picture. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified here. The vulnerability is not currently listed in the CISA KEV catalog and no POC has been identified, which moderates urgency compared to a KEV-listed flaw. However, Adobe ColdFusion has historically attracted targeted exploitation - multiple prior ColdFusion CVEs appear in CISA KEV - meaning threat actor interest in this platform is confirmed and future exploitation of this issue cannot be ruled out. The authentication bypass nature (PR:N) combined with high confidentiality impact means this should be treated as high priority for any organization with internet-exposed ColdFusion instances, regardless of the current absence of known exploits. |
| Exploit ScenarioDerived | An unauthenticated attacker sends specially crafted HTTP requests to a publicly accessible ColdFusion 2023 or 2025 server, exploiting the failure to properly validate input to circumvent a security enforcement mechanism such as an authentication gate or access filter. With the bypass in place, the attacker reads sensitive server-side data - potentially including configuration files, application data, or credentials - and makes limited modifications to stored data. No user interaction or prior account access is required, making this exploitable via automated scanning tools. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security controls, gaining unauthorized read and limited write access to affected systems. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a low-complexity, network-exploitable flaw requiring no privileges or user interaction, elevating real-world risk for any internet-facing ColdFusion deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but ColdFusion's history as a high-value target warrants prompt patching.
RemediationAI
Apply the update issued by Adobe under security bulletin APSB26-90, available at https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html. Exact fixed build numbers are not independently confirmed in the available input data and must be verified directly in the advisory. While patching is underway, organizations should consider restricting network access to ColdFusion administrator interfaces and the ColdFusion server itself to trusted IP ranges, as this reduces the network attack surface for unauthenticated exploitation. Additionally, deploying a Web Application Firewall (WAF) with rules targeting ColdFusion-specific request patterns can provide a compensating control, though WAF bypass is possible and this should not be treated as a permanent substitute for patching. Disabling unused ColdFusion features and endpoints may further reduce exposure if operationally feasible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe ColdFusion is a commercial application server and CFML-based web development platform widely used in enterprise environments. CWE-20 (Improper Input Validation) indicates the root cause is insufficient sanitization or validation of attacker-supplied input, allowing crafted requests to circumvent one or more security enforcement mechanisms. In ColdFusion's context, this class of flaw commonly manifests in request filtering, authentication gates, or access control enforcement layers that fail to properly reject or sanitize malformed inputs. Affected products confirmed via CPE are cpe:2.3:a:adobe:coldfusion_2025 and cpe:2.3:a:adobe:coldfusion_2023, covering all versions of both major release lines. The scope is unchanged (S:U), meaning the vulnerability is contained within the ColdFusion process boundary, but the high confidentiality impact (C:H) suggests access to sensitive server-side data or configuration.
Know when Coldfusion 2025 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-exploitable with no authentication or interaction required; C:H reflects unauthorized read access, I:L reflects limited write capability, A:N as no availability impact is described.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.
Executive ViewAI
Adobe ColdFusion 2023 and 2025 contain a high-severity input validation vulnerability (CVE-2026-21279, CVSS 8.2) enabling unauthenticated attackers to bypass security controls and gain unauthorized read and limited write access. No public exploit identified at time of analysis, but internet-facing ColdFusion deployments face significant risk due to the vulnerability's network-exploitable nature and lack of available patch. Leadership should prioritize immediate remediation or deployment of compensating controls to prevent data breach and unauthorized system access.
No vendor-released patch identified at time of analysis. Deploy interim controls: (1) Web Application Firewall (WAF) rules to detect and block exploitation attempts targeting input validation; (2) network segmentation restricting ColdFusion application access to trusted internal networks; (3) comprehensive logging and monitoring of all ColdFusion instances for unauthorized access, anomalous requests, or data export attempts; (4) application-level input validation hardening through ColdFusion security configuration settings; (5) isolation of internet-facing ColdFusion deployments from sensitive backend systems and data stores. Monitor vendor security advisories continuously for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Coldfusion 2025
View allOS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary op
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorizati
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthoriz
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrat
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authoriz
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass securit
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitra
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptogra
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security co
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate
Exploit-DB