EUVD-2026-74067
GHSA-8wcg-23qv-r8rm
Severity by source
AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
AV:A confirmed by admin-zone restriction; PR:L per description; UI:R for file-open requirement; S:C and full C/I/A reflect arbitrary code execution with scope escape.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Remote code execution in Adobe ColdFusion 2025 (≤update 12) and 2023 (≤update 23) allows a low-privileged attacker with adjacent network access to execute arbitrary code in the context of the victim user by delivering a malicious file for the target to open. The vulnerable component is confined to the administrative network zone by default, and the attack requires scope change - meaning successful exploitation can extend impact beyond the ColdFusion process itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker must have adjacent-network access to the ColdFusion administrative zone - the vulnerable component is restricted to this zone by default, so internet-facing or isolated deployments are not reachable without prior network compromise; (2) the attacker must hold at least a low-privileged account within ColdFusion or the affected administrative interface (PR:L); and (3) a victim user within that zone must be socially engineered into opening an attacker-controlled malicious file (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.4 score reflects a genuine but access-constrained threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patches released under Adobe security bulletin APSB26-119 (https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html): update ColdFusion 2025 to a version beyond update 12, and ColdFusion 2023 to a version beyond update 23. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ColdFusion 2025 (≤update 12) and 2023 (≤update 23) instances, verify whether each is deployed on the administrative network zone, and identify any systems that accept external file delivery or uploads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today