Adobe ColdFusion CVE-2026-76001

Requires an authenticated low-privileged account on the ColdFusion server (PR:L) and affects ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13). The vendor states exploitation 'depends on conditions beyond the attacker's control' (reflected as AC:H), meaning success is not deterministic and likely hinges on race timing, specific internal-network reachability, or environmental state rather than a single reliable request. No user interaction is required (UI:N). Limiting factors that reduce realistic risk: the required authenticated foothold, the high attack complexity, and impact that is primarily disclosure of internal resources (C:H) with only limited integrity impact (I:L) and no availability impact.

This is a moderate-severity SSRF (CWE-918) in Adobe ColdFusion with a vendor-assigned CVSS 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N). The signals are internally consistent but point to a conditional, not drive-by, threat: the network vector (AV:N) and no-user-interaction requirement are offset by high attack complexity (AC:H) and a required low-privilege account (PR:L), and the description explicitly states 'Exploit depends on conditions beyond the attacker's control,' which corroborates AC:H. The changed scope (S:C) with C:H reflects the SSRF reaching internal resources outside the initially vulnerable component, which drives the score up. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization and the probability of mass exploitation cannot be quantified from the data given. On balance this is a real but mid-tier priority: it is not a remote-unauthenticated RCE, it requires an existing authenticated foothold plus favorable conditions, and it should be patched on a normal prioritized cycle rather than treated as an emergency - reassess immediately if it later appears in CISA KEV or a POC is published.

A low-privileged ColdFusion user (e.g., a limited authenticated application account) crafts a request that coerces the ColdFusion server into making attacker-controlled requests to internal, otherwise unreachable resources, escalating their effective access and reading sensitive internal data. Because attack complexity is high, success depends on timing or configuration conditions outside the attacker's direct control. No public exploit identified at time of analysis.