What is the CVSS score of CVE-2026-34635?

CVE-2026-34635 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Adobe ColdFusion are affected by CVE-2026-34635?

Adobe ColdFusion 2023 and 2025 contain a hard-coded cryptographic key enabling local, low-privileged users to bypass security controls and compromise interconnected systems.

How to fix or mitigate CVE-2026-34635?

Within 24 hours: inventory all ColdFusion 2023 and 2025 instances across your infrastructure and identify systems with local user access; immediately restrict local login privileges to ColdFusion servers to an approved administrator list and isolate affected servers from critical systems where feasible. Within 7 days: implement enhanced monitoring and logging on ColdFusion authentication, inter-system API calls, and database access patterns; review and apply principle-of-least-privilege controls to ColdFusion-dependent applications and services; evaluate business continuity impact of migrating to unaffected ColdFusion versions or alternative platforms. Within 30 days: establish daily monitoring for Adobe security bulletins and patch availability; prepare an accelerated patching protocol to apply updates immediately upon release; maintain heightened vigilance for suspicious authentication, privilege escalation, or lateral movement indicators in logs.

Adobe ColdFusion CVE-2026-34635

EUVD-2026-56541 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-08-11 adobe

GHSA-73xh-3v46-mfvh

Authentication Bypass Adobe Coldfusion 2025 Coldfusion 2023

8.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.4 HIGH

Local low-privileged access required to extract embedded key; scope changes to cross-component security bypass; no availability impact from key misuse.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 17:27 vuln.today

CVE Published

Aug 11, 2026 - 16:31 nvd

HIGH 8.4

DescriptionCVE.org

is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass security controls and gain unauthorized read and write access with scope change to components beyond the vulnerable server. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H) confirms local access with minimal complexity is sufficient - no user interaction is needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the deterministic, non-rotating nature of a hard-coded key means any attacker who extracts it retains persistent capability until the key is replaced via patch.

Technical ContextAI

CWE-321 (Use of Hard-coded Cryptographic Key) describes a class of vulnerability where an application embeds a cryptographic secret - such as an encryption key, HMAC secret, or signing key - directly in source code or compiled binaries. Because the key is static and identical across all installations, any attacker who recovers it from one instance can apply it universally against all deployments of that version. Adobe ColdFusion is a commercial CFML-based application server widely used for enterprise web applications, particularly in government and legacy environments. The affected products are confirmed by CPE strings cpe:2.3:a:adobe:coldfusion_2025 and cpe:2.3:a:adobe:coldfusion_2023 (all sub-versions wildcard), indicating both major release lines are vulnerable. The scope change (S:C) in the CVSS vector indicates the vulnerability's impact propagates beyond the ColdFusion process boundary to affect other system components or security domains.

RemediationAI

The primary remediation is to apply the vendor-released patch detailed in Adobe Security Bulletin APSB26-90 (https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html); the exact fixed build version must be obtained from that advisory, as it was not independently confirmed in the available intelligence data. Until patching is complete, compensating controls should focus on restricting local access: limit the number of OS-level accounts with access to the ColdFusion server host, enforce principle of least privilege on service accounts, and audit who can read ColdFusion installation directories and configuration files where hard-coded keys may be stored or referenced. Network segmentation to isolate ColdFusion hosts reduces lateral movement risk if an attacker already has local access. Note that workarounds cannot eliminate the hard-coded key itself - they only reduce the attacker's ability to reach the vulnerable system. Rotating secrets or re-keying is not possible without a vendor fix since the key is embedded in application code.