Adobe ColdFusion EUVD-2026-100503

No special conditions - per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), remote unauthenticated exploitation is possible without user interaction against affected ColdFusion servers. The limiting factors are version and exposure: only ColdFusion 2023 at or below update 2023.0.25 and ColdFusion 2025 at or below update 2025.0.13 are affected, and the instance must be network-reachable by the attacker for the AV:N vector to apply. The description provides no feature-flag or non-default-configuration prerequisite, so default internet-facing deployments on vulnerable versions appear exploitable; confirm any additional preconditions against Adobe APSB26-144.

All available signals point to a genuinely network-exposed, easy-to-trigger information disclosure flaw, but the real-world priority is moderated by the absence of exploitation telemetry. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable issue requiring no privileges, no user interaction, and low complexity, with high confidentiality impact (C:H) and no integrity or availability impact - consistent with the CWE-863 Incorrect Authorization root cause and the described leak of sensitive process memory. No EPSS score, no CISA KEV listing, and no POC indicator were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 7.5 base score reflects potential, not observed, abuse. A key caveat: the description characterizes the flaw as an authorization defect disclosing 'sensitive memory,' which typically yields partial/opportunistic data rather than full secret extraction, yet the vector asserts C:H - treat the full-confidentiality rating as the vendor's conservative worst case and verify the actual scope of leaked data against the Adobe advisory. The input Tags label this 'Authentication Bypass,' which conflicts with the CWE-863 Incorrect Authorization classification (an authenticated-vs-authorization distinction) - verify the precise mechanism with Adobe APSB26-144. Given ColdFusion's long history of appearing in CISA KEV, defenders should patch promptly even without current exploitation data, treating this as a credible pre-exploitation disclosure primitive.

A remote, unauthenticated attacker sends a crafted request to an internet-exposed ColdFusion 2023 (≤2023.0.25) or 2025 (≤2025.0.13) instance, triggering the incorrect authorization check and causing the server to return fragments of sensitive process memory. Because exploitation requires no user interaction and no privileges (AV:N/AC:L/PR:N/UI:N), the attacker can repeat the request to harvest leaked memory that may contain tokens, credentials, or internal data useful for follow-on attacks. No public exploit code was identified at time of analysis, so this scenario is inferred from the CVSS vector and description rather than a confirmed PoC.