What is the CVSS score of CVE-2026-34619?

CVE-2026-34619 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Coldfusion are affected by CVE-2026-34619?

Adobe ColdFusion versions 2023.18, 2025.6 and earlier contain a path traversal vulnerability allowing authenticated users to access unauthorized files and disrupt system availability.

How to fix or mitigate CVE-2026-34619?

Within 24 hours: Identify all ColdFusion 2023.18 and 2025.6 deployments in your environment and document affected systems. Within 7 days: Implement network segmentation to restrict ColdFusion administrative interfaces to trusted IP ranges and enforce multi-factor authentication for all ColdFusion user accounts. Within 30 days: Monitor Adobe security advisories (APSB26-38) for patch availability and plan immediate deployment upon release; in parallel, evaluate migration to patched versions when available.

Coldfusion CVE-2026-34619

EUVD-2026-22762 HIGH

Path Traversal (CWE-22)

2026-04-14 psirt@adobe.com

Path Traversal Coldfusion

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 14:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 22:41 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:22 euvd

EUVD-2026-22762

Analysis Generated

Apr 14, 2026 - 22:22 vuln.today

CVE Published

Apr 14, 2026 - 22:16 nvd

HIGH 7.7

DescriptionCVE.org

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction.

AnalysisAI

Path traversal in Adobe ColdFusion 2023.18, 2025.6 and earlier allows authenticated remote attackers to bypass security controls and cause high availability impact through unauthorized file system access. CVSS 7.7 (High) reflects network-accessible attack vector with low complexity requiring only low-privilege authentication and scope change indicating impact beyond vulnerable component. No active exploitation (CISA KEV) or public POC identified at time of analysis, but zero-interaction exploitation pathway and vendor security advisory publication (APSB26-38) indicate concrete threat requiring prompt remediation.

Technical ContextAI

Adobe ColdFusion is a rapid web application development platform using CFML (ColdFusion Markup Language) for dynamic content generation. This vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal or directory traversal. The flaw occurs when the application fails to properly sanitize user-supplied input used in file system operations, allowing attackers to use special character sequences (such as '../' or absolute paths) to escape intended directory boundaries. In ColdFusion contexts, path traversal can affect file upload handlers, template inclusion mechanisms, or administrative functions that interact with the file system. The Changed Scope (S:C) in the CVSS vector suggests the vulnerability impacts resources beyond the ColdFusion application itself, potentially affecting the underlying operating system or adjacent services through unauthorized file access.

RemediationAI

Apply vendor-released security updates immediately per Adobe Security Bulletin APSB26-38 available at https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html. The advisory provides specific patched versions and installation instructions for affected release branches. Organizations should prioritize patching internet-facing ColdFusion instances and servers with multiple authenticated users. As interim mitigation while testing patches, implement defense-in-depth controls including restricting ColdFusion administrator access to trusted IP ranges via web server or firewall rules, enforcing principle of least privilege for ColdFusion user accounts, enabling comprehensive file access logging to detect exploitation attempts, and reviewing existing ColdFusion applications for proper input validation on file path parameters. Monitor Adobe security bulletins for follow-up guidance as path traversal vulnerabilities may have multiple variants requiring successive patches.