EUVD-2026-100663
GHSA-48pv-77qw-wrfw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed ColdFusion endpoint
-
DeliverySend resource-intensive requests
-
ExploitTrigger uncontrolled resource consumption
-
ExecutionExhaust CPU/memory/threads
-
ImpactApplication denial-of-service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The description specifies no special feature, protocol, or non-default configuration requirement - exploitation is remote and unauthenticated against a reachable ColdFusion application (AV:N/AC:L/PR:N/UI:N), explicitly requiring no user interaction. The primary limiting factor is network reachability: the ColdFusion application server (versions 2025 ≤2025.0.13 or 2023 ≤2023.0.25) must be accessible to the attacker, so instances behind restrictive network controls or not internet-exposed face reduced risk. Impact is confined to availability (service disruption); there is no confidentiality or integrity exposure, and the issue is fully remediated by applying the Adobe APSB26-144 updates. |
| Impact | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects a network-reachable, low-complexity, unauthenticated vulnerability whose entire weight comes from the availability impact (A:H), with no confidentiality or integrity consequence (C:N/I:N). This is a classic denial-of-service profile consistent with the CWE-400 (Uncontrolled Resource Consumption) classification and the vendor's description. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from probabilistic signals - the assessment rests on the CVSS vector and Adobe's advisory alone. There is no public exploit identified at time of analysis and no evidence of active exploitation, so despite the 'High'-band score this is a priority driven by ease of access rather than confirmed in-the-wild activity. The practical risk is real for internet-exposed ColdFusion instances (resource exhaustion can take an application offline with no authentication), but the impact is limited to availability - there is no data breach or code-execution dimension here. Note the discrepancy to verify: the input provides no EPSS/KEV/POC data at all, so 'low real-world exploitation signal' is an absence of data, not a confirmed low-probability finding. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted or high-volume requests to an internet-facing ColdFusion application server, triggering uncontrolled consumption of a system resource (CPU, memory, threads, or connections). As resources are exhausted, the ColdFusion application becomes unresponsive and legitimate users are denied service. No public exploit code has been identified, and the attack requires no user interaction or authentication (AV:N/PR:N/UI:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote resource exhaustion in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows an attacker to drive a reachable application server into an application-level denial-of-service by consuming system resources, with CVSS 3.1 scoring the issue 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) so the entire impact rests on availability. No special feature, protocol, or non-default configuration is required and no user interaction is involved; the practical limiting factor is network reachability, making internet-exposed instances the highest-risk population. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this should be treated as a patch-now availability risk rather than an actively exploited campaign; Adobe ships fixes in advisory APSB26-144.
RemediationAI
Primary fix: apply the vendor updates referenced in Adobe security advisory APSB26-144 (https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html), which supersede the affected builds ColdFusion 2025.0.13 and 2023.0.25; patch status is patch available per vendor advisory, with the exact patched build numbers to be taken from that bulletin rather than assumed. Until maintenance windows allow the upgrade, reduce the attack surface with compensating controls whose trade-offs are understood: place the ColdFusion server behind a reverse proxy or WAF that enforces per-source request rate limits, request-body size caps, and aggressive request timeouts (side effect: these can throttle or truncate legitimate heavy-load applications and must be tuned to real traffic baselines); restrict network reachability of the ColdFusion administration and application ports to trusted networks so only intended clients can trigger the resource-consuming path (side effect: breaks direct remote access for developers or integrations); and add JVM heap, thread-pool, and connection-pool monitoring with alerting and a controlled restart runbook so exhaustion is detected and recovered quickly (side effect: restarts interrupt in-flight sessions). Do not rely on these controls as a substitute for the vendor patch, since they only raise the cost of triggering the denial-of-service condition rather than removing the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ColdFusion is Adobe's commercial CFML application server, a JVM-based runtime that handles HTTP requests through an embedded servlet container, template compiler, session/state management, and shared thread, connection, and heap pools. CWE-400 (Uncontrolled Resource Consumption) describes the root-cause class here: the application does not adequately bound the resources a request or session can allocate, so a remote party can force repeated or oversized consumption of a finite pool (heap memory, worker threads, database connections, temporary file or cache space) until the service can no longer serve legitimate traffic. The assessed vector AV:N/AC:L/PR:N/UI:N/S:U confirms the attack is launched over the network with low complexity, without credentials, and without tricking a user; the unchanged scope (S:U) and C:N/I:N mean the flaw stays confined to availability and does not expose or alter data. The EUVD version data scopes the exposure to the ColdFusion 2025 and 2023 release trains through 2025.0.13 and 2023.0.25 respectively, and the description does not name the specific exhausted resource, so defenders should treat the whole request-handling and JVM resource surface as the mitigable area rather than assuming a single endpoint.
Know when Coldfusion gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor description confirms unauthenticated, no-interaction network exploitation (AV:N/PR:N/UI:N/AC:L) causing resource exhaustion with availability-only impact, hence C:N/I:N/A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
Executive ViewAI
Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) can be driven into an application-level denial of service by an unauthenticated remote attacker who consumes server resources, meaning any internet-reachable ColdFusion instance is a candidate target with no credentials or user interaction required. The impact is confined to availability, but for organizations running customer-facing or revenue-supporting ColdFusion applications that translates directly into outage risk, degraded service levels, and incident response costs. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this should be managed as an urgent availability-remediation effort rather than an active-compromise investigation.
No vendor-released patch was identified at time of analysis; interim mitigations include restricting network reachability to trusted sources, WAF or edge rate limiting and request throttling, load balancer concurrency caps and connection timeouts, CPU/memory/thread-pool monitoring with automated alerting, redundant or autoscaling capacity to absorb exhaustion attempts, and rapid failover procedures. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote attacker upload a fi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Exploit-DB