EUVD-2026-74070
GHSA-xpgf-3q64-7g87
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable with no auth or interaction required; impact is read-only file disclosure, so I:N and A:N.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
3DescriptionCVE.org
ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction.
AnalysisAI
Arbitrary file system read in Adobe ColdFusion 2023 (Update ≤23) and ColdFusion 2025 (Update ≤12) exposes sensitive files and directories outside the intended access scope to unauthenticated remote attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation requiring no credentials and no user interaction, with high confidentiality impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for initial exploitation: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations of Adobe ColdFusion 2023 (Update ≤23) and ColdFusion 2025 (Update ≤12). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 score with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects a high-severity, low-friction confidentiality exposure: any internet-reachable ColdFusion instance in these version ranges is potentially accessible without credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the latest available ColdFusion update per Adobe advisory APSB26-119 (https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Adobe ColdFusion 2023 (Update 23 or earlier) and ColdFusion 2025 (Update 12 or earlier) instances; document network exposure and data sensitivity classifications for each system. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today