EUVD-2026-56537
GHSA-f5fp-2q73-jccr
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent admin-zone reachability gives AV:A with no auth (PR:N) or interaction; incorrect authorization yields high read/write (C:H/I:H) and DoS (A:H) with a changed scope (S:C).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorization checks (CWE-863, Incorrect Authorization) and obtain unauthorized read and write access, potentially forcing an application denial-of-service. The flaw carries a CVSS 9.6 (scope-changed) rating and requires no user interaction, though the vulnerable component sits inside an administrative network zone by default. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires adjacent-network reachability to ColdFusion's administrative component (CVSS AV:A), which Adobe states is restricted to an administrative network zone by default - so the attacker must already be on, or able to route to, that management segment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The raw signals are severe: CVSS 9.6 with AV:A/AC:L/PR:N/UI:N/S:C and High confidentiality, integrity, and availability impact means low-effort, unauthenticated exploitation once an attacker reaches the relevant network segment, and a mid-sized municipal IT team in kalisz running an internet-exposed or flat-network ColdFusion instance should treat this as urgent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply the ColdFusion 2023 and ColdFusion 2025 updates described in Adobe security bulletin APSB26-90 (https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html) and confirm the exact fixed update level there, as no specific fix version is included in this dataset. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Adobe ColdFusion 2023 and 2025 deployments, including development, staging, and production systems; document their network location and data sensitivity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Coldfusion 2025
View allOS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary op
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthoriz
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrat
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authoriz
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass securit
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security c
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitra
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptogra
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security co
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today