EUVD-2026-56550
GHSA-r223-53g4-479g
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Administrative interface accessible only from adjacent network zone (AV:A); authorization bypass requires no credentials (PR:N); arbitrary code execution yields full CIA impact with no scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction.
AnalysisAI
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authorization controls and execute arbitrary code in the context of the ColdFusion service account. The vulnerable administrative component is confined to an administrative network zone by default, limiting internet-scale exposure but leaving internal networks and misconfigured deployments at significant risk. No public exploit code or CISA KEV listing has been identified at time of analysis, though the complete CIA impact and zero-authentication requirement make this a high-priority patch target for any organization running ColdFusion.
Technical ContextAI
Adobe ColdFusion is a commercial application server and CFML runtime used heavily in enterprise web application development. CWE-863 (Incorrect Authorization) describes a failure where the application performs an operation without properly verifying that the requester holds the necessary permissions - distinct from authentication failure (CWE-287): the system does not require credentials at all for the affected administrative function, allowing a network-adjacent party to invoke privileged operations directly. CPE strings confirm that both product lines - ColdFusion 2023 (cpe:2.3:a:adobe:coldfusion_2023) and ColdFusion 2025 (cpe:2.3:a:adobe:coldfusion_2025) - are affected across all patch levels, indicated by the wildcard version fields. The CVSS vector's AV:A metric is consistent with Adobe's own note that the vulnerable component is restricted to an administrative network zone by default, meaning the attack surface is the admin interface rather than the public-facing application tier.
RemediationAI
Apply the patch specified in Adobe Security Advisory APSB26-90 (https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html) - exact fixed version numbers are not included in the available input data and must be retrieved directly from that advisory. As a compensating control prior to patching, verify that the ColdFusion Administrator interface is strictly isolated to a dedicated management network zone and is not reachable from general internal segments, VPN pools, or any internet-facing path; this is the default posture but is frequently relaxed in practice. Additionally, implement host-based firewall rules or network ACLs to restrict access to the ColdFusion admin port (typically 8500 or the configured admin port) to a named list of authorized administrator source IPs only - this directly restricts the AV:A attack surface. Note that blocking admin port access may interrupt legitimate ColdFusion administration workflows and should be coordinated with application teams.
More in Coldfusion 2025
View allOS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary op
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorizati
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthoriz
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrat
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass securit
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security c
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitra
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptogra
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security co
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today