EUVD-2026-35833
GHSA-f6w2-335h-mp8w
Severity by source
AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Adjacent vector (AV:A) and high privileges (PR:H) are consistent with description; scope change (S:C) confirmed by code execution extending beyond application boundary.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
9DescriptionNVD
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Incorrect Authorization in Adobe ColdFusion 2023.x and 2025.x enables a high-privileged attacker on an adjacent network to execute arbitrary code in the context of the current user, with a scope change that extends impact beyond the application boundary. Reported by Adobe PSIRT and covered under advisory APSB26-64, this vulnerability carries a CVSS score of 8.4 despite requiring adjacent-network positioning and pre-existing high privileges - signals that meaningfully constrain realistic exploitation. No public exploit code has been identified and EPSS sits at 0.02% (6th percentile), consistent with SSVC's 'Exploitation: none' classification at time of analysis.
Technical ContextAI
Adobe ColdFusion is a commercial Java-based application server platform widely used for rapid enterprise web application development. The affected versions span ColdFusion 2023 (base release through Update 17, per CPE strings cpe:2.3:a:adobe:coldfusion:2023 through cpe:2.3:a:adobe:coldfusion:2023:update17) and ColdFusion 2025 through version 2025.8. The root cause is CWE-863 (Incorrect Authorization), meaning the application performs access control enforcement but with flawed logic or criteria - the authorization check exists but can be bypassed by an already-authenticated high-privileged user to gain access to resources or operations outside their intended permission scope. The CVSS Scope:Changed (S:C) metric confirms the exploitation crosses a security boundary, affecting components or system resources beyond ColdFusion's own security domain - consistent with the description's reference to arbitrary code execution that could affect the underlying host or session context.
RemediationAI
The primary remediation is to upgrade Adobe ColdFusion to a version beyond the affected releases: apply updates above ColdFusion 2023 Update 19 for the 2023 track, or above version 2025.8 for the 2025 track, per Adobe advisory APSB26-64 at https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html. If immediate patching is not feasible, restrict adjacent-network access to the ColdFusion administrative interface and application endpoints using network-layer controls (firewall rules, VLAN segmentation) to ensure only authorized administrators can reach the server - this directly addresses the AV:A attack vector. Additionally, audit and minimize the number of accounts holding high-privilege roles within ColdFusion, as PR:H means the exploitable attack surface is limited to already-elevated users; revoking unnecessary admin-level grants reduces the attacker pool. Note that network segmentation alone does not eliminate the risk if insider threats or compromised admin accounts are in scope.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets remote attackers (PR:N) read arbitrary
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today