EUVD-2026-44548
GHSA-48rg-3g52-267g
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
ColdFusion admin interface is network-accessible (AV:N); PR:H reflects mandatory high-privilege prerequisite; only limited write access gained, so I:L with no C or A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
AnalysisAI
Insufficient session expiration in Adobe ColdFusion 2023 (through Update 21) and 2025 (through Update 10) allows a high-privileged authenticated attacker to reuse sessions that should have been invalidated, bypassing security controls to gain unauthorized write access. The CVSS score of 2.7 reflects the significant constraint of PR:H - the attacker must already hold high-level ColdFusion credentials. SSVC classification of exploitation:none and an EPSS of 0.35% (28th percentile) confirm no active exploitation or public exploit code at time of analysis.
Technical ContextAI
CWE-613 (Insufficient Session Expiration) describes a class of flaws where application sessions remain valid beyond their intended lifetime - typically after logout, privilege change, or administrative session rotation. In ColdFusion's case, session tokens that should be invalidated server-side can be reused by an attacker who has obtained them, bypassing the security boundary that the expiration mechanism is meant to enforce. The affected surface is Adobe ColdFusion's web application runtime, confirmed by CPE strings cpe:2.3:a:adobe:coldfusion:2023 covering the base release through update 17 per NVD, and extended to update 21 by EUVD data. The network attack vector (AV:N) is consistent with ColdFusion's administrator and server interfaces being HTTP-accessible, but PR:H indicates the session in question belongs to a high-privileged operator account.
RemediationAI
The primary fix is to upgrade to Adobe ColdFusion 2023 Update 22 or Adobe ColdFusion 2025 Update 11, per patch versions confirmed by EUVD and the Adobe advisory APSB26-82 (https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html). As a compensating control where patching is delayed, administrators should enforce explicit server-side session invalidation on logout and privilege changes via ColdFusion's Application.cfc sessionInvalidate() mechanism, and configure aggressive session timeout values in the ColdFusion Administrator under Server Settings > Memory Variables. Additionally, restricting network access to the ColdFusion Administrator interface to trusted management networks reduces the exposure surface for any session-related abuse. Note that session timeout reduction may affect legitimate user workflows and should be communicated to application owners before implementation.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote attacker upload a fi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today