EUVD-2026-56545
GHSA-v75c-vpwj-ppq3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or compromise low-privilege ColdFusion credential
-
DeliverySend crafted network request to ColdFusion endpoint
-
ExploitTrigger incorrect authorization check in application logic
-
ExecutionCrash ColdFusion server process
-
ImpactApplication unavailable to legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privilege credential on the target ColdFusion instance (CVSS PR:L confirmed) - this is the primary limiting factor. No special non-default configuration, specific feature enablement, or user interaction is required beyond possessing that credential and having network access to the ColdFusion server (AV:N/AC:L/UI:N). Impact is strictly limited to availability loss (A:H/C:N/I:N/S:U), meaning no data exfiltration or integrity compromise results from this vulnerability. Organizations that do not expose ColdFusion to untrusted networks and tightly control low-privilege account provisioning have materially reduced exposure; organizations with guest accounts or externally reachable ColdFusion instances face higher risk. |
| Impact | The CVSS 3.1 score of 6.5 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), low-privilege (PR:L) attack with no user interaction (UI:N) delivering full availability loss (A:H) and no confidentiality or integrity impact (C:N/I:N/S:U). No EPSS score was supplied in the input data, so exploitation probability cannot be quantified numerically. No CISA KEV listing and no public proof-of-concept are identified, indicating this is not currently being widely exploited. Despite the Medium label, real-world operational risk is meaningful: any credentialed low-privilege account - including accounts issued to contractors, limited application users, or obtained via credential stuffing - can repeatedly crash the ColdFusion server with no complexity overhead. The absence of user interaction and low attack complexity mean sustained DoS is trivially maintained. Scope unchanged (S:U) limits lateral blast radius to the directly affected ColdFusion instance, but availability loss of a web application server is high-impact for dependent business processes. |
| Exploit ScenarioDerived | An attacker who possesses or has obtained a valid low-privilege ColdFusion account sends a crafted HTTP request that reaches the authorization-flawed code path, triggering a crash of the ColdFusion application server process. Because attack complexity is low and no user interaction is required, the attacker can issue this request repeatedly to maintain a persistent denial-of-service condition against the targeted deployment. No public proof-of-concept exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
ColdFusion 2023 and 2025 contain an Incorrect Authorization flaw (CWE-863) that allows any low-privileged authenticated user to remotely crash the application server, producing a denial-of-service condition. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only network access and a valid low-privilege credential with no interaction from other users, making repeated service disruption trivial for any credentialed attacker. No public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Vendor-released patches are available: upgrade ColdFusion 2023 to patch level 2023.0.23 or later, and ColdFusion 2025 to patch level 2025.0.12 or later, as detailed in Adobe Security Bulletin APSB26-90 at https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html. Where immediate patching is not feasible, restrict ColdFusion application and administrative interfaces to trusted internal network segments or VPN-only access to reduce the pool of potential low-privilege accounts that could reach the vulnerable endpoint - note this does not eliminate risk from insider threats or already-compromised credentials. Additionally, enforce strict account lifecycle controls to minimize the number of active low-privilege ColdFusion accounts, and implement process-level monitoring and auto-restart policies to reduce mean time to recovery if the crash is triggered.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe ColdFusion is a Java-based application server for CFML (ColdFusion Markup Language) web applications, widely used in enterprise environments. CWE-863 (Incorrect Authorization) indicates the application performs an authorization check but the check is insufficiently enforced - a low-privileged user is permitted to invoke operations or reach code paths that should be restricted to higher-privilege contexts, in this case triggering a crash of the application server process. Affected CPEs are cpe:2.3:a:adobe:coldfusion_2023:*:*:*:*:*:*:*:* (all sub-versions through 2023.0.22) and cpe:2.3:a:adobe:coldfusion_2025:*:*:*:*:*:*:*:* (all sub-versions through 2025.0.11). The vendor-assigned tag 'Authentication Bypass' suggests the authorization logic is bypassed rather than simply weakened, allowing a low-privilege session to exercise privileges beyond its role boundary.
Know when Coldfusion 2025 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
PR:L required because valid low-privilege credentials are prerequisite; A:H reflects full application crash; C:N/I:N confirmed by DoS-only impact description.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Coldfusion 2025
View allOS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary op
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorizati
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthoriz
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrat
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authoriz
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass securit
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security c
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitra
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptogra
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security co
Exploit-DB