EUVD-2026-35833
GHSA-f6w2-335h-mp8w
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description states high-privileged remote attacker with no user interaction, scope changes to total impact via arbitrary code execution, so PR:H, S:C, C/I/A:H.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Privilege escalation and arbitrary code execution in Adobe ColdFusion 2023 (Update 17 and earlier) and 2025 (Update 8 and earlier) allows a high-privileged remote attacker to bypass authorization controls and execute code in the context of the current user. The flaw is a CWE-863 incorrect-authorization issue with a scope change, raising CVSS to 9.1, but no public exploit identified at time of analysis and EPSS is low (0.02%, 6th percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated, high-privileged ColdFusion principal (CVSS PR:H) - i.e., access at the level of a ColdFusion administrator or equivalently privileged role - reachable over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and worth reconciling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already obtained high-privileged ColdFusion credentials (for example, via credential reuse, a prior compromise, or a phished administrator) authenticates to the server and invokes the affected functionality, where the broken authorization check fails to constrain the action to its intended scope. Because S:C, the attacker's action breaks out of the authorization context and executes arbitrary code under the running ColdFusion user, yielding host-level command execution; no user interaction is needed and no public exploit identified at time of analysis. |
| Remediation | Apply the vendor-released patch from Adobe Security Bulletin APSB26-64 (https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html) by upgrading ColdFusion 2023 beyond Update 17 (2023.19) and ColdFusion 2025 beyond Update 8 to the Adobe-published fixed updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all ColdFusion 2023 and 2025 installations to identify affected versions (≤Update 17 for 2023, ≤Update 8 for 2025). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today