EUVD-2026-40338
GHSA-cvwp-w8m7-5589
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable unauthenticated upload-to-RCE with no user interaction and a changed scope yields full CIA impact, consistent with a 10.0 base.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases stems from an unrestricted dangerous-file-type upload (CWE-434) that lets a remote attacker drop and execute a malicious payload, such as a CFM/CFML webshell, in the context of the running ColdFusion user. Rated CVSS 10.0 with a changed scope, it requires no user interaction and, per the provided vector, no authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The required prerequisite is network reachability to a ColdFusion instance exposing an affected file-upload code path, with a writable, web-served destination so an uploaded CFML/JSP template can subsequently be executed - the dangerous-type upload itself is the condition (CWE-434). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to genuine, top-tier priority rather than an inflated CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker scans for internet-facing ColdFusion servers and sends a crafted HTTP POST to a vulnerable upload handler, submitting a malicious .cfm webshell whose dangerous type is not rejected. The server writes the file into a web-accessible directory; the attacker then requests that URL, executing arbitrary CFML as the ColdFusion service account and gaining interactive control of the host. … |
| Remediation | Apply the Adobe ColdFusion security update referenced in advisory APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html); upgrade beyond the affected 2025.9 and 2023.20 builds to the patched update levels Adobe lists there - the input does not provide the exact fixed build string, so confirm the target version directly from the advisory and treat APSB26-68 as the patch source (patch available per vendor advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all ColdFusion instances and confirm installed versions (2025.9, 2023.20, earlier); restrict network access to upload endpoints and ColdFusion administrative interfaces using firewall rules; disable file upload functionality where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets remote attackers (PR:N) read arbitrary
Share
External POC / Exploit Code
Leaving vuln.today