EUVD-2026-44553
GHSA-fvhv-fqj3-3vhm
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable low-complexity SQLi but vendor scopes it to high-privilege actors (PR:H); changed scope and stated RCE justify S:C and full C/I/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
SQL injection in Adobe ColdFusion 2023 and 2025 lets an attacker with high privileges inject crafted SQL that escalates to arbitrary code execution in the context of the current user, with a changed scope that extends impact beyond the vulnerable component. The flaw (CWE-89, CVSS 9.1) affects ColdFusion 2023 through Update 21 and ColdFusion 2025 through Update 10, requires no user interaction, and was disclosed by Adobe PSIRT. There is no public exploit identified at time of analysis, and EPSS is modest at 0.69% (49th percentile).
Technical ContextAI
Adobe ColdFusion is a commercial rapid web-application server that compiles CFML into Java and brokers database access through built-in tags and functions such as cfquery. This vulnerability is a classic CWE-89 Improper Neutralization of Special Elements in an SQL Command: user- or attacker-controlled input reaches a database query without adequate parameterization or escaping, allowing the query structure to be altered. Because ColdFusion runs on the JVM with broad platform integration, SQL injection here is not merely a data-disclosure issue - Adobe indicates it can be leveraged to arbitrary code execution in the context of the current user, consistent with the SQLi-to-RCE pattern historically seen in ColdFusion. The affected builds are identified by CPEs of the form cpe:2.3:a:adobe:coldfusion:2023:updateN, covering the 2023 base release through Update 17 in the supplied CPE set and, per EUVD, up to Update 21.
RemediationAI
Vendor-released patch: ColdFusion 2023 Update 22 and ColdFusion 2025 Update 11, which resolve this issue per Adobe advisory APSB26-82 (https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html); upgrade affected ColdFusion 2023 (≤Update 21) and 2025 (≤Update 10) installations to these builds as the primary fix. As compensating controls until patching, apply Adobe's ColdFusion Lockdown Guide and enforce least privilege for the datasource accounts ColdFusion uses so that a successful injection yields minimal database rights (trade-off: may break application features that assume broad DB permissions), restrict administrative and privileged access to the ColdFusion Administrator and any high-privilege application functions since exploitation requires PR:H (trade-off: tighter access management overhead), and place the server behind a WAF with SQL-injection signatures and restrict network exposure of management interfaces (trade-off: WAF rules can produce false positives and are not a substitute for the patch). Validate that all database queries use parameterized cfqueryparam bindings in custom CFML.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote attacker upload a fi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today