EUVD-2026-40346
GHSA-39jm-g7jr-7w2j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network RCE with no user interaction (AV:N/AC:L/PR:N/UI:N), full triad impact, and scope change to the host justify S:C and C/I/A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and earlier lets a remote attacker run code in the context of the current user with no authentication and no user interaction. The flaw stems from improper input validation (CWE-20) and carries a maximum CVSS of 10.0 with a changed scope, meaning impact can extend beyond the vulnerable component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no special conditions are required - remote unauthenticated exploitation is possible over the network against affected configurations of Adobe ColdFusion, and the description explicitly states exploitation does not require user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Every signal that is present points to high real-world risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H scores a perfect 10.0, describing a network-reachable, low-complexity, unauthenticated attack with no user interaction and full confidentiality, integrity, and availability impact plus scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker reaches an internet-facing ColdFusion server and submits a crafted request to a vulnerable input-processing endpoint, where missing input validation causes attacker-controlled data to be executed, yielding code execution in the context of the ColdFusion process; because scope is changed, the attacker can then pivot to the underlying host. No public exploit identified at time of analysis, but the low attack complexity and lack of authentication make reliable weaponization plausible. |
| Remediation | Apply the fixed ColdFusion releases distributed by Adobe in advisory APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html); Patch available per vendor advisory, though the exact patched build numbers were not included in the provided data and should be read directly from that advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all ColdFusion 2025.9 and 2023.20 instances in your environment and immediately restrict their internet-facing access; contact Adobe support for patch timeline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets remote attackers (PR:N) read arbitrary
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today