Adobe ColdFusion CVE-2026-34633

Exploitation requires a valid low-privileged authenticated account on the affected ColdFusion instance (CVSS PR:L); it is not exploitable by fully unauthenticated attackers. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The description does not name a specific feature or configuration toggle, implying the SSRF is reachable in default configurations of ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13) once authenticated. The primary limiting factor is the authentication requirement, so real-world risk is highest where low-privileged ColdFusion accounts are widely provisioned or where the server is internet-facing and internal resources (e.g., cloud metadata services) are reachable from it.

This is a moderate-severity, authenticated SSRF (CWE-918) in Adobe ColdFusion with a vendor-assigned CVSS 3.1 base of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). The vector signals network-reachable, low-complexity exploitation requiring a low-privileged account, with a changed scope and high confidentiality impact but no integrity or availability impact - consistent with an SSRF that pivots to read internal resources rather than achieving code execution. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization: this currently reads as a credible but not emergent priority. The main caveats are that the CVSS was supplied by Adobe PSIRT and not independently reproduced here, and that the PR:L requirement meaningfully limits blast radius - an attacker must first hold valid low-privileged credentials, so this is more relevant to environments where ColdFusion accounts are broadly provisioned or where credential theft is plausible. Prioritize patching on internet-facing ColdFusion where low-privileged accounts exist, but absent KEV/EPSS/POC signals this does not demand same-day emergency response.

A low-privileged attacker with a valid ColdFusion account sends a crafted request that coerces the server into making attacker-controlled outbound requests, reaching internal-only services (cloud metadata endpoints, internal admin interfaces, or back-end APIs) that the attacker could not otherwise reach. Because scope is changed and confidentiality impact is high, the attacker reads sensitive internal data or obtains credentials/tokens enabling further privilege escalation. No public exploit code was identified at time of analysis, and no user interaction is required.