EUVD-2026-56543
GHSA-mg6q-gc3j-2v4j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-reachable but requires a low-privileged account; scope unchanged and no confidentiality impact, consistent with a bounded security-filter bypass.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.
AnalysisAI
ColdFusion 2023 and ColdFusion 2025 contain an improper output encoding flaw (CWE-116) enabling low-privileged network attackers to circumvent security controls, achieve limited unauthorized write access, and cause modest availability disruption. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is network-reachable, requires only a low-privileged account, and needs no user interaction. No public exploit code has been identified and CISA SSVC assigns exploitation status of none; vendor-released patches are available as ColdFusion 2023 update 2023.0.23 and ColdFusion 2025 update 2025.0.12 per Adobe advisory APSB26-90.
Technical ContextAI
Adobe ColdFusion is an enterprise rapid-application-development platform and application server. CWE-116 (Improper Encoding or Escaping of Output) describes a root cause where application-generated data is placed into an output context without adequate sanitization, allowing that data to subvert the interpretation layer - in this case, bypassing one or more of ColdFusion's built-in security controls. The vulnerability affects both the 2023 and 2025 product lines as confirmed by CPE strings cpe:2.3:a:adobe:coldfusion_2023 and cpe:2.3:a:adobe:coldfusion_2025. The S:U (unchanged scope) CVSS metric indicates the flaw is contained within the ColdFusion application boundary and does not directly escape to the underlying operating system, consistent with a security-filter bypass rather than a full remote code execution primitive.
RemediationAI
Vendor-released patches are available: upgrade Adobe ColdFusion 2023 to update 2023.0.23 and Adobe ColdFusion 2025 to update 2025.0.12, as confirmed by ENISA EUVD and Adobe advisory APSB26-90 (https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html). If immediate patching is not possible, restrict access to the ColdFusion administrator and application interfaces to known trusted IP ranges using network-layer controls such as a WAF or firewall ACL, which reduces the pool of potential low-privileged attackers who can reach the endpoint. Additionally, audit and minimise the number of active low-privilege ColdFusion accounts to reduce the attack surface; removing unnecessary accounts eliminates credential paths an attacker could exploit. Note that IP restriction alone does not eliminate risk from insider threats or already-compromised internal hosts.
More in Coldfusion 2025
View allOS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary op
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorizati
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthoriz
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrat
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authoriz
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass securit
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security c
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitra
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptogra
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security co
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today