EUVD-2026-74072
GHSA-mx44-53mh-83m6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Remote authenticated high-privilege attacker (PR:H) exploits SQLi with no user interaction; injection pivots beyond the DB to code execution, justifying S:C and full C:H/I:H/A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 23) and ColdFusion 2025 (through Update 12) is possible through an SQL injection flaw (CWE-89) that a high-privileged authenticated attacker can escalate into code execution in the context of the current user. The CVSS vector marks the scope as changed, reflecting that database-layer injection pivots into broader application/OS impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated, high-privileged ColdFusion account (CVSS PR:H) with network reach to the vulnerable ColdFusion 2023 (≤Update 23) or 2025 (≤Update 12) application; no user interaction is needed (UI:N) and the attack is remote over the network (AV:N) with low complexity (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), but the single most important limiter is PR:H - exploitation requires an already high-privileged authenticated account, which substantially narrows the realistic attacker population compared to a pre-auth flaw and argues against fully automated mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed ColdFusion updates published in Adobe security bulletin APSB26-119 (https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html) - install the next cumulative update above the affected ceilings (later than ColdFusion 2023 Update 23 and later than ColdFusion 2025 Update 12); consult the bulletin for the exact patched build numbers rather than assuming them. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your ColdFusion deployment to identify running versions and catalog all high-privilege user accounts with access to ColdFusion administration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today